{"id":"CVE-2025-69412","details":"KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.","modified":"2026-08-12T15:14:58.874779Z","published":"2025-12-31T23:20:55.785Z","database_specific":{"cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69412.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://developers.google.com/safe-browsing/v4"},{"type":"WEB","url":"https://developers.google.com/safe-browsing/v4/lookup-api"},{"type":"WEB","url":"https://github.com/KDE/messagelib/compare/v25.11.80...v25.11.90"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69412.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69412"},{"type":"FIX","url":"https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kde/messagelib","events":[{"introduced":"0"},{"fixed":"81d0bbffdd7919e5e951bf893c5d054102f97813"},{"fixed":"01adef0482bb3d5c817433db5208620c84a992b3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"25.11.90"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v25.11.80","v24.01.90","v24.01.85","v24.01.80","v24.01.75","v19.07.80","v17.11.80","v17.07.80","v16.11.80"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69412.json","vanir_signatures_modified":"2026-08-12T15:14:58Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"247102080454140445278807094198843041167","length":278},"id":"CVE-2025-69412-3341d1ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/checkphishingurljob.cpp","function":"CheckPhishingUrlJob::slotSslErrors"}},{"deprecated":false,"digest":{"line_hashes":["189803499842410880278693176566031155382","295465336199449180951910272813593965609","29535838893051329906184700870623651685","107162341442944455720388121535181316171"],"threshold":0.9},"id":"CVE-2025-69412-540b8023","signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/createphishingurldatabasejob.h"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/searchfullhashjob.h"},"deprecated":false,"digest":{"line_hashes":["327076565499342336629559112476470034364","184854466108492269141698443155367379372","62411414880555032890370284325707300482","31581962162360840796845883202761848596"],"threshold":0.9},"id":"CVE-2025-69412-57e89096"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/checkphishingurljob.cpp","function":"CheckPhishingUrlJob::CheckPhishingUrlJob"},"deprecated":false,"digest":{"function_hash":"16595314924505878769694780307857536986","length":662},"id":"CVE-2025-69412-639db6ff"},{"digest":{"line_hashes":["284800492353272502615185421514129997541","184854466108492269141698443155367379372","62411414880555032890370284325707300482","229519636213746222311113278162458368710"],"threshold":0.9},"id":"CVE-2025-69412-7ffdc628","signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/checkphishingurljob.h"},"deprecated":false},{"target":{"file":"webengineviewer/src/checkphishingurl/createphishingurldatabasejob.cpp"},"deprecated":false,"digest":{"line_hashes":["30533534155258722385867582978427086795","211811503537468069404272192450237812634","69471432110590285668013934209321051194","256274067889310728774519371562339505395","50543018115372181891164945733361489871","202359521106345234243335734083556325771","254445964567112001016783680962290159564","71266004300204698686155491109090253378","232320105128457006802425477699975091518","24172488447633758063073534192757032385","138066407036146805378149167992405796217"],"threshold":0.9},"id":"CVE-2025-69412-8a269338","signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3"},{"deprecated":false,"digest":{"function_hash":"256369801189348538485778761716173943678","length":274},"id":"CVE-2025-69412-8eccd0d3","signature_type":"Function","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"function":"SearchFullHashJob::slotSslErrors","file":"webengineviewer/src/checkphishingurl/searchfullhashjob.cpp"}},{"deprecated":false,"digest":{"line_hashes":["204962871260004479380125479133469571977","292526621139149432150901442242866114180","12773743552272659386140408220786406289","186518216810990804896709961231481529907","131183597879498428956355581153264157266","283975210712205716392108679368081743471","282807292170243006918175554184023191527","284771718902777374462560505021352711093","69606276922023580568823722648959654490","103464088373995303934865097700855410148","78662362953449623311788182742939045171"],"threshold":0.9},"id":"CVE-2025-69412-b3de5b03","signature_type":"Line","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/searchfullhashjob.cpp"}},{"digest":{"function_hash":"298783257015222379147186034410254172256","length":296},"id":"CVE-2025-69412-ba5e87be","signature_type":"Function","signature_version":"v1","source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/createphishingurldatabasejob.cpp","function":"CreatePhishingUrlDataBaseJob::slotSslErrors"},"deprecated":false},{"source":"https://github.com/kde/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3","target":{"file":"webengineviewer/src/checkphishingurl/checkphishingurljob.cpp"},"deprecated":false,"digest":{"line_hashes":["92280337932978690019159889351572066502","4220465855716612051429396431212393540","40296109455296819533900534623270585994","309168200500391801860753387112137857610","15226293527122381452617177446967936293","111262021432512392919002477530902633070","4769713228461819591863564167796327708","52579593200952171123799443036430354353","118160700038180806577936688686262260433","222817283456998920970826672216178474614","339918176743609301429366214377344009183"],"threshold":0.9},"id":"CVE-2025-69412-cabd20e0","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"}]}