Candidate: CVE-2016-7967
PublicDate: 2016-12-23 22:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7967
 http://www.openwall.com/lists/oss-security/2016/10/05/1
 https://www.kde.org/info/security/advisory-20161006-2.txt
Description:
 KMail since version 5.3.0 used a QWebEngine based viewer that had
 JavaScript enabled. Since the generated html is executed in the local file
 security context by default access to remote and local URLs was enabled.
Ubuntu-Description:
Notes:
 mdeslaur> 5.3.0 and over
 sbeattie> kmail did not use QWebSettings through zesty
Bugs:
 https://bugs.launchpad.net/bugs/1630699
Priority: medium
Discovered-by: Roland Tapken
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N [8.1 HIGH]

Patches_kdepim:
upstream_kdepim: needs-triage
precise_kdepim: not-affected (4:4.8.5-0ubuntu0.1)
precise/esm_kdepim: DNE (precise was not-affected [4:4.8.5-0ubuntu0.1])
trusty_kdepim: not-affected (4:4.13.3-0ubuntu0.1)
trusty/esm_kdepim: not-affected (4:4.13.3-0ubuntu0.1)
vivid/stable-phone-overlay_kdepim: DNE
vivid/ubuntu-core_kdepim: DNE
xenial_kdepim: not-affected (code not present)
yakkety_kdepim: ignored (reached end-of-life)
zesty_kdepim: not-affected (code not present)
devel_kdepim: DNE

Patches_kf5-messagelib:
 upstream: https://cgit.kde.org/messagelib.git/commit/?id=dfc6a86f1b25f1da04b8f1df5320fcdd7085bcc1
upstream_kf5-messagelib: released (16.11.80)
precise_kf5-messagelib: DNE
precise/esm_kf5-messagelib: DNE
trusty_kf5-messagelib: DNE
trusty/esm_kf5-messagelib: DNE
vivid/stable-phone-overlay_kf5-messagelib: DNE
vivid/ubuntu-core_kf5-messagelib: DNE
xenial_kf5-messagelib: DNE
yakkety_kf5-messagelib: ignored (reached end-of-life)
zesty_kf5-messagelib: not-affected (code not present)
devel_kf5-messagelib: released (4:16.12.3-0ubuntu1)