CVE-2016-7967

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94CWE-284

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 23, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-79686.5KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript aCVE-2016-79697.5The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds reCVE-2016-79707.5Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of serviceCVE-2016-79727.5The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory aCVE-2016-79739.8The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.CVE-2016-79749.8The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.CVE-2016-79759.8The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().CVE-2016-79768.8The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.CVE-2016-79775.5Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files viaCVE-2016-79789.8Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference lCVE-2016-79799.8Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code bCVE-2016-79808.8Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack t
CVE-2016-7967: High severity, CVSS 8.1 | Vulnix