CVE-2016-7966
Fixed in a distro release EPSS 2%
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Products: kde kmail, debian_linux, fedoraproject fedora, suse linux_enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | kcoreaddons | 5.26.0-2 |
| Debian 12 | kcoreaddons | 5.26.0-3 |
| Debian 13 | kcoreaddons | 5.26.0-3 |
| Debian 14 | kcoreaddons | 5.26.0-3 |
| Debian 7 | kdepimlibs | 4:4.8.4-2+deb7u1 |
| Debian 8 | kdepimlibs | 4:4.14.2-2+deb8u2 |
| SUSE Package Hub 12 SP1 | kcoreaddons | 5.20.0-6.1 |
| Ubuntu 14.04 LTS | kdepimlibs | 4:4.13.3-0ubuntu0.4 |
| Ubuntu 16.04 LTS | kcoreaddons | 5.18.0-0ubuntu1.1 |