CVE-2016-7966

Publication date 5 October 2016

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
kcoreaddons	17.04 zesty	Fixed 5.26.0-0ubuntu2
	16.10 yakkety	Fixed 5.26.0-0ubuntu2
	16.04 LTS xenial	Fixed 5.18.0-0ubuntu1.1
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not in release
kdepim	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected
kdepimlibs	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Fixed 4:4.13.3-0ubuntu0.4
	12.04 LTS precise	Fixed 4:4.8.5-0ubuntu0.3
kf5-messagelib	17.04 zesty	Not affected
	16.10 yakkety	Ignored end of life
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not in release

Notes

mdeslaur

per ScottK: Affected package is kdepimlibs in 12.04 - 15.04 and it looks like both kcoreaddons and messagecomposer in later releases

tsimonq2

An additional part to this was released, therefore we need additional commits on top of the initial fix.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
kcoreaddons	Upstream: ?id=96e Upstream: ?id=1be Upstream: ?id=5e1 Upstream: ?id=a06
kdepimlibs	Upstream: ?id=176 Upstream: ?id=8bb

Severity score breakdown

Parameter	Value
Base score	7.3 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

USN-3100-1
KDE-PIM Libraries vulnerability
12 October 2016