PT-2016-7451 · Kde · Kmail

Publicado 2016-12-23 · Atualizado 2016-12-27 · CVE-2016-7968

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KMail versions 5.3.0 and later

Description The issue concerns the execution of JavaScript code in HTML mail contents. Since version 5.3.0, KMail has used a QWebEngine based viewer with JavaScript enabled, but it did not sanitize HTML mail contents for JavaScript, allowing included code to be executed.

Recommendations For KMail versions 5.3.0 and later, consider disabling JavaScript execution in the QWebEngine based viewer as a temporary workaround until a patch is available.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2016-7968

Produtos afetados

Kmail

Referências · 8

• https://osv.dev/vulnerability/CVE-2016-7968 · Aviso do Fabricante
• http://securityfocus.com/bid/93360 · Nota
• https://cve.org/CVERecord?id=CVE-2016-7968 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-7968 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/10/05/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7968 · Nota de Segurança
• https://kde.org/info/security/advisory-20161006-3.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7968 · Aviso do Fabricante