Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

the new package fixes the CVE-2016-7966. for more info please take a look at https://www.kde.org/info/security/advisory-20161006-1.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

KDE PIM Applications 16.08.2, https://www.kde.org/announcements/announce-applications-16.08.2.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Roland Tapken discovered that insufficient input sanitising in KMail's plain text viewer allowed the injection of HTML code.

Roland Tapken discovered that insufficient input sanitizing in KMail's plain text viewer allowed attackers the injection of HTML code. This might open the way to the exploitation of other vulnerabilities in the HTML viewer code, which is disabled by default.

For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-2+deb7u1.

We recommend that you upgrade your kdepimlibs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for kcoreaddons fixes the following issues :

  - CVE-2016-7966: HTML injection in plain text viewer     (boo#1002977)

Roland Tapken discovered that the KDE-PIM Libraries incorrectly filtered URLs. A remote attacker could use this issue to perform an HTML injection attack in the KMail plain text viewer.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
94836	Fedora 25 : kdepimlibs (2016-92c112a380)	Nessus	Fedora Local Security Checks	high
94750	Fedora 23 : kdepimlibs (2016-f7a079f775)	Nessus	Fedora Local Security Checks	high
94525	Fedora 24 : kdepimlibs (2016-c9d15bbcbb)	Nessus	Fedora Local Security Checks	high
94413	Fedora 24 : 1:kdepim-runtime / 7:kdepim / kdepim-addons / kdepim-apps-libs / etc (2016-1b042a79bd)	Nessus	Fedora Local Security Checks	high
94205	Debian DSA-3697-1 : kdepimlibs - security update	Nessus	Debian Local Security Checks	high
94204	Debian DLA-673-1 : kdepimlibs security update	Nessus	Debian Local Security Checks	high
94128	openSUSE Security Update : kcoreaddons (openSUSE-2016-1200)	Nessus	SuSE Local Security Checks	high
94044	Ubuntu 12.04 LTS : kdepimlibs vulnerability (USN-3100-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-7966

high

Tenable Plugins

high

high

high

high

high

high

high

high