CVE-2016-7968

MEDIUM

KMail < 5.3.0 - Remote Code Execution via JavaScript in HTML Email

Title source: llm
STIX 2.1

Description

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93360
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/05/1

Scores

CVSS v3 6.5
EPSS 0.0015
EPSS Percentile 34.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-94
Status published
Products (1)
kde/kmail < 5.3.0
Published Dec 23, 2016
Tracked Since Feb 18, 2026