CVE Feed

    Dashboard / CVE / CVE-2016-7967

    CVE-2016-7967

    KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

    Published:Oct 4, 2016
    Last Modified:Apr 12, 2025
    EPS:Dec 23, 2016
    EPSS Score:0.00332
    CVSS Score:8.1

    Affected Products

    Vendor
    Kde
    Product
    Kmail

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-19 Embedding Scripts within Scripts
    CAPEC-242 Code Injection
    CAPEC-35 Leverage Executable Code in Non-Executable Files
    CAPEC-441 Malicious Logic Insertion
    CAPEC-478 Modification of Windows Service Configuration
    CAPEC-479 Malicious Root Certificate
    CAPEC-502 Intent Spoof
    CAPEC-503 WebView Exposure
    CAPEC-536 Data Injected During Configuration
    CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment
    CAPEC-550 Install New Service
    CAPEC-551 Modify Existing Service
    CAPEC-552 Install Rootkit
    CAPEC-556 Replace File Extension Handlers
    CAPEC-558 Replace Trusted Executable
    CAPEC-562 Modify Shared File
    CAPEC-563 Add Malicious File to Shared Webroot
    CAPEC-564 Run Software at Logon
    CAPEC-578 Disable Security Software
    CAPEC-77 Manipulating User-Controlled Variables

    Related CVEs

    CVE-2024-50624 (CVSS 5.9) — ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-co…
    CVE-2021-38373 (CVSS 5.3) — In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) u…
    CVE-2020-15954 (CVSS 6.5) — KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates th…
    CVE-2020-11880 (CVSS 6.5) — An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=...…
    CVE-2019-10732 (CVSS 4.3) — In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts wit…
    CVE-2017-17689 (CVSS 5.9) — The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly l…
    CVE-2017-9604 (CVSS 7.5) — KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not …
    CVE-2016-7968 (CVSS 6.5) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were …
    CVE-2016-7966 (CVSS 7.3) — Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint…
    CVE-2014-8878 (CVSS 5.9) — KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High