messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not     properly restrict the handling of an http-equiv=REFRESH value. (CVE-2018-19516)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for messagelib fixes the following issues :

The following security vulnerability was addressed :

  - CVE-2018-19516: Fix a potential issue with opening     messages in a new browser window when displaying mails     as HTML (boo#1117958).

Albert Astals Cid reports :

messagelib is the library used by KMail to display emails.

messagelib by default displays emails as plain text, but gives the user an option to 'Prefer HTML to plain text' in the settings and if that option is not enabled there is way to enable HTML display when an email contains HTML.

Some HTML emails can trick messagelib into opening a new browser window when displaying said email as HTML.

This happens even if the option to allow the HTML emails to access remote servers is disabled in KMail settings.

This means that the owners of the servers referred in the email can see in their access logs your IP address.

ID	Name	Product	Family	Severity
254493	Linux Distros Unpatched Vulnerability : CVE-2018-19516	Nessus	Misc.	medium
123399	openSUSE Security Update : messagelib (openSUSE-2019-981)	Nessus	SuSE Local Security Checks	medium
119541	openSUSE Security Update : messagelib (openSUSE-2018-1508)	Nessus	SuSE Local Security Checks	medium
119273	FreeBSD : messagelib -- HTML email can open browser window automatically (c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-19516

medium

Tenable Plugins

medium

medium

medium

medium