PublicDateAtUSN: 2016-10-05
Candidate: CVE-2016-7966
PublicDate: 2016-12-23 22:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7966
 http://www.openwall.com/lists/oss-security/2016/10/05/1
 https://www.kde.org/info/security/advisory-20161006-1.txt
 https://ubuntu.com/security/notices/USN-3100-1
Description:
 Through a malicious URL that contained a quote character it was possible to
 inject HTML code in KMail's plaintext viewer. Due to the parser used on the
 URL it was not possible to include the equal sign (=) or a space into the
 injected HTML, which greatly reduces the available HTML functionality.
 Although it is possible to include an HTML comment indicator to hide
 content.
Ubuntu-Description:
Notes:
 mdeslaur> per ScottK: Affected package is kdepimlibs in 12.04 - 15.04 and
 mdeslaur> it looks like both kcoreaddons and messagecomposer in later
 mdeslaur> releases
 tsimonq2> An additional part to this was released, therefore we need
 tsimonq2> additional commits on top of the initial fix.
Bugs:
 https://bugs.launchpad.net/bugs/1630700
 https://bugs.launchpad.net/bugs/1631237
Priority: medium
Discovered-by: Roland Tapken
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L [7.3 HIGH]

Patches_kdepim:
upstream_kdepim: not-affected (code not present)
precise_kdepim: not-affected (code not present)
precise/esm_kdepim: DNE (precise was not-affected [code not present])
trusty_kdepim: not-affected (code not present)
trusty/esm_kdepim: not-affected (code not present)
vivid/stable-phone-overlay_kdepim: DNE
vivid/ubuntu-core_kdepim: DNE
xenial_kdepim: not-affected (code not present)
yakkety_kdepim: not-affected (code not present)
zesty_kdepim: not-affected (code not present)
devel_kdepim: DNE

Patches_kdepimlibs:
 upstream: https://cgit.kde.org/kdepimlibs.git/commit/?id=176fee25ca79145ab5c8e2275d248f1a46a8d8cf
 upstream: https://cgit.kde.org/kdepimlibs.git/commit/?id=8bbe1bd3fdc55f609340edc667ff154b3d2aaab1
upstream_kdepimlibs: needed
precise_kdepimlibs: released (4:4.8.5-0ubuntu0.3)
precise/esm_kdepimlibs: DNE (precise was released [4:4.8.5-0ubuntu0.3])
trusty_kdepimlibs: released (4:4.13.3-0ubuntu0.4)
trusty/esm_kdepimlibs: released (4:4.13.3-0ubuntu0.4)
vivid/stable-phone-overlay_kdepimlibs: DNE
vivid/ubuntu-core_kdepimlibs: DNE
xenial_kdepimlibs: not-affected (code not present)
yakkety_kdepimlibs: not-affected (code not present)
zesty_kdepimlibs: not-affected (code not present)
devel_kdepimlibs: DNE

Patches_kf5-messagelib:
upstream_kf5-messagelib: needs-triage
precise_kf5-messagelib: DNE
precise/esm_kf5-messagelib: DNE
trusty_kf5-messagelib: DNE
trusty/esm_kf5-messagelib: DNE
vivid/stable-phone-overlay_kf5-messagelib: DNE
vivid/ubuntu-core_kf5-messagelib: DNE
xenial_kf5-messagelib: DNE
yakkety_kf5-messagelib: ignored (reached end-of-life)
zesty_kf5-messagelib: not-affected
devel_kf5-messagelib: not-affected

Patches_kcoreaddons:
 upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=96e562d9138c100498da38e4c5b4091a226dde12
 upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=1be7272373d60e4234f1a5584e676b579302b053
 upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=5e13d2439dbf540fdc840f0b0ab5b3ebf6642c6a
 upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=a06cef31cc4c908bc9b76bd9d103fe9c60e0953f (automatic tests, not mandatory but very helpful)
upstream_kcoreaddons: needs-triage
precise_kcoreaddons: DNE
precise/esm_kcoreaddons: DNE
trusty_kcoreaddons: DNE
trusty/esm_kcoreaddons: DNE
vivid/stable-phone-overlay_kcoreaddons: DNE
vivid/ubuntu-core_kcoreaddons: DNE
xenial_kcoreaddons: released (5.18.0-0ubuntu1.1)
yakkety_kcoreaddons: released (5.26.0-0ubuntu2)
zesty_kcoreaddons: released (5.26.0-0ubuntu2)
devel_kcoreaddons: released (5.26.0-0ubuntu2)