CVE-2016-7966

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

Metrics

CVSS 3.0 7.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2016-10/msg00065.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3697Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
http://www.securityfocus.com/bid/93360Third Party Advisory, VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNMM5TVPTJQFPJ3YDF4DPXDFW3GQLWLY/
http://lists.opensuse.org/opensuse-updates/2016-10/msg00065.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3697Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
http://www.securityfocus.com/bid/93360Third Party Advisory, VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNMM5TVPTJQFPJ3YDF4DPXDFW3GQLWLY/

Timeline

Published: Dec 23, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-79678.1KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file CVE-2016-79686.5KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript a CVE-2016-79697.5The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds re CVE-2016-79707.5Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service CVE-2016-79727.5The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory a CVE-2016-79739.8The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.CVE-2016-79749.8The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.CVE-2016-79759.8The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().CVE-2016-79768.8The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.CVE-2016-79775.5Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via CVE-2016-79789.8Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference l CVE-2016-79799.8Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code b