CVE-2016-7967

HIGH

KMail < 5.3.0 - Improper Access Control via QWebEngine JavaScript Execution

Title source: llm
STIX 2.1

Description

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93360
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/05/1

Scores

CVSS v3 8.1
EPSS 0.0030
EPSS Percentile 53.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Details

CWE
CWE-284 CWE-94
Status published
Products (1)
kde/kmail < 5.3.0
Published Dec 23, 2016
Tracked Since Feb 18, 2026