CVE-2017-9604

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8Mailing List, Patch, Tool Signature
https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197Mailing List, Patch, Tool Signature
https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8Mailing List, Patch, Tool Signature
https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197Mailing List, Patch, Tool Signature

Timeline

Published: Jun 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-96055.5The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the CVE-2017-96067.3Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file CVE-2017-96077.0The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the CVE-2017-96086.5The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer derefere CVE-2017-96095.4Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via th CVE-2017-96107.8The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (CVE-2017-96117.8The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-bas CVE-2017-96127.8The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-CVE-2017-96135.4Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbit CVE-2017-96148.8The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory acc CVE-2017-96159.8Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbos CVE-2017-96165.5In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion (uncontrolled recursion) in the dissect_mp4_box function in epan/disse