Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2016-7966

Published: 5 October 2016

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

Notes

AuthorNote
mdeslaur
per ScottK: Affected package is kdepimlibs in 12.04 - 15.04 and
it looks like both kcoreaddons and messagecomposer in later
releases
tsimonq2
An additional part to this was released, therefore we need
additional commits on top of the initial fix.

Priority

Medium

Cvss 3 Severity Score

7.3

Score breakdown

Status

Package Release Status
kcoreaddons
Launchpad, Ubuntu, Debian
yakkety
Released (5.26.0-0ubuntu2)
zesty
Released (5.26.0-0ubuntu2)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial
Released (5.18.0-0ubuntu1.1)
Patches:
upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=96e562d9138c100498da38e4c5b4091a226dde12
upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=1be7272373d60e4234f1a5584e676b579302b053
upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=5e13d2439dbf540fdc840f0b0ab5b3ebf6642c6a
upstream: https://cgit.kde.org/kcoreaddons.git/commit/?id=a06cef31cc4c908bc9b76bd9d103fe9c60e0953f (automatic tests, not mandatory but very helpful)


kdepim
Launchpad, Ubuntu, Debian
precise Not vulnerable
(code not present)
trusty Not vulnerable
(code not present)
upstream Not vulnerable
(code not present)
xenial Not vulnerable
(code not present)
yakkety Not vulnerable
(code not present)
zesty Not vulnerable
(code not present)
kdepimlibs
Launchpad, Ubuntu, Debian
precise
Released (4:4.8.5-0ubuntu0.3)
trusty
Released (4:4.13.3-0ubuntu0.4)
upstream Needed

xenial Not vulnerable
(code not present)
yakkety Not vulnerable
(code not present)
zesty Not vulnerable
(code not present)
Patches:




upstream: https://cgit.kde.org/kdepimlibs.git/commit/?id=176fee25ca79145ab5c8e2275d248f1a46a8d8cf
upstream: https://cgit.kde.org/kdepimlibs.git/commit/?id=8bbe1bd3fdc55f609340edc667ff154b3d2aaab1
kf5-messagelib
Launchpad, Ubuntu, Debian
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

yakkety Ignored
(end of life)
zesty Not vulnerable

Severity score breakdown

Parameter Value
Base score 7.3
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L