PT-2016-7451 · Kde · Kmail

Published 2016-12-23 · Updated 2016-12-27 · CVE-2016-7968

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KMail versions 5.3.0 and later

Description The issue concerns the execution of JavaScript code in HTML mail contents. Since version 5.3.0, KMail has used a QWebEngine based viewer with JavaScript enabled, but it did not sanitize HTML mail contents for JavaScript, allowing included code to be executed.

Recommendations For KMail versions 5.3.0 and later, consider disabling JavaScript execution in the QWebEngine based viewer as a temporary workaround until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2016-7968

Affected Products

Kmail

References · 8

• https://osv.dev/vulnerability/CVE-2016-7968 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7968 · Security Note
• https://ubuntu.com/security/CVE-2016-7968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7968 · Security Note
• https://kde.org/info/security/advisory-20161006-3.txt · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7968 · Vendor Advisory
• http://securityfocus.com/bid/93360 · Note
• http://openwall.com/lists/oss-security/2016/10/05/1 · Note