CVE-2016-7967

High

Published: 23/12/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. The generated HTML is executed in the local file security context by default, allowing access to remote and local URLs.

Risk Assessment

The ability to execute malicious JavaScript code may lead to unauthorized access to user data and potential attacks on the system.

Recommendation

It is recommended to update KMail to the latest version to disable JavaScript or restrict access to local and remote URLs.

Other vulnerabilities in KMail

CVE-2016-7966High
A malicious URL containing a quote character allowed for HTML code injection in KMail's plaintext viewer. The parser used on the URL restricts injection capabilities by preventing the inclusion of the equal sign (=) or a space, significantly limiting HTML functionality.

Original NVD description (English source)

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.