Launchpad.net

Launchpad Home
Code
Bugs
Blueprints
Translations
Answers

CVE 2016-7968

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.

Related bugs and status

CVE-2016-7968 (Candidate) is related to these bugs:

Bug #1630699: [CVE] KMail - JavaScript access to local and remote URLs

Summary				In	Importance	Status
	1630699	[CVE] KMail - JavaScript access to local and remote URLs		kf5-messagelib (Ubuntu)	Critical	Fix Released
	1630699	[CVE] KMail - JavaScript access to local and remote URLs		kf5-messagelib (Ubuntu Zesty)	Undecided	Invalid

See the

CVE page on Mitre.org for more details.

References

MLIST: [oss-security] 2016100...
BID: 93360