PT-2016-7450 · Kde · Kmail

Published 2016-12-23 · Updated 2016-12-27 · CVE-2016-7967

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions KMail versions 5.3.0 and later

Description The issue concerns the use of a QWebEngine based viewer in KMail that has JavaScript enabled. This allows the generated HTML to be executed in the local file security context, enabling access to both remote and local URLs by default.

Recommendations For KMail versions 5.3.0 and later, consider disabling JavaScript in the QWebEngine based viewer to minimize the risk of exploitation.

Fix

Improper Access Control

Code Injection

Weakness Enumeration

CWE-284

CWE-94

Related Identifiers

CVE-2016-7967

Affected Products

Kmail

References · 8

• https://osv.dev/vulnerability/CVE-2016-7967 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-7967 · Security Note
• https://ubuntu.com/security/CVE-2016-7967 · Vendor Advisory
• https://kde.org/info/security/advisory-20161006-2.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7967 · Vendor Advisory
• http://securityfocus.com/bid/93360 · Note
• http://openwall.com/lists/oss-security/2016/10/05/1 · Note