CVE-2016-7966

High

Published: 23/12/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A malicious URL containing a quote character allowed for HTML code injection in KMail's plaintext viewer. The parser used on the URL restricts injection capabilities by preventing the inclusion of the equal sign (=) or a space, significantly limiting HTML functionality.

Risk Assessment

An attacker could exploit this vulnerability to hide malicious code in email messages, potentially leading to unauthorized access to user data.

Recommendation

It is recommended to update KMail to the latest version to mitigate risks associated with this vulnerability and to monitor email messages for suspicious links.

Other vulnerabilities in KMail

CVE-2016-7967High
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. The generated HTML is executed in the local file security context by default, allowing access to remote and local URLs.

Original NVD description (English source)

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.