← Back

CVE-2016-7966

nvd nist
Published: Dec 23, 2016Modified: May 6, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability: 3.9 / Impact: 3.4
Source: NVD

Description

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

Affected (4)

Products: Kde: Kmail · Debian: Debian Linux · Fedoraproject: Fedora · +1 more
Show all products
Kde: Kmail · Debian: Debian Linux · Fedoraproject: Fedora · Suse: Linux Enterprise
Kde
1 product
Kmail
Debian
1 product
Debian Linux
Fedoraproject
1 product
Fedora
Suse
1 product
Linux Enterprise
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kmail
Up to 4.4.0
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 8.0
Fedora
Version 25
Linux Enterprise
Version 12.0

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (10)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.