CVE-2016-7967 KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs...
HighCVSS 8.1
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDE kmail | <= 5.3.0 | No fix listed |
References
- [oss-security] 20161004 Re: KMail vulnerabilites: need 3 CVE mailing-list third-party-advisory
- 93360 third-party-advisory vdb-entry
- www.kde.org vendor-advisory
- Debian Security Tracker CVE-2016-7967 vendor-advisory