CVE-2025-69412
Publication date 1 January 2026
Last updated 7 January 2026
Ubuntu priority
Description
KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which might allow spoofing of threat data. NOTE: this Lookup API is not contacted in the messagelib default configuration.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| kf5-messagelib | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release | |
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| messagelib | 26.04 LTS resolute |
Needs evaluation
|
| 25.10 questing |
Needs evaluation
|
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
3.4 · Low
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2025-69412
- https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3 (v25.11.90)
- https://developers.google.com/safe-browsing/v4
- https://developers.google.com/safe-browsing/v4/lookup-api
- https://github.com/KDE/messagelib/commit/01adef0482bb3d5c817433db5208620c84a992b3
- https://github.com/KDE/messagelib/compare/v25.11.80...v25.11.90