CVE-2016-7966: Code Injection
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7966?
The severity of CVE-2016-7966 is classified as a moderate security issue.
How do I fix CVE-2016-7966?
To resolve CVE-2016-7966, upgrade KMail to versions later than 4.4.0 or apply the appropriate patches provided for your affected distribution.
Which versions of KMail are affected by CVE-2016-7966?
CVE-2016-7966 affects KMail versions up to and including 4.4.0.
Is there any workaround for CVE-2016-7966?
Currently, there are no known workarounds for CVE-2016-7966; the recommended action is to update the software.
What type of attack can CVE-2016-7966 enable?
CVE-2016-7966 enables injection of limited HTML code through a malicious URL in KMail's plaintext viewer.