Vulnerability Description
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
CVSS Score
8.1
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kde | Kmail | <= 5.3.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
- http://www.securityfocus.com/bid/93360Third Party AdvisoryVDB Entry
- https://www.kde.org/info/security/advisory-20161006-2.txtVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
- http://www.securityfocus.com/bid/93360Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-7967?
CVE-2016-7967 is a vulnerability with a CVSS score of 8.1 (HIGH). KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs...
How severe is CVE-2016-7967?
CVE-2016-7967 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-7967?
Check the references section above for vendor advisories and patch information. Affected products include: Kde Kmail.