CVE-2016-7967
UnknownEPSS 1.92%
Last modified
CVE-2016-7967 is a vulnerability of currently unknown severity. KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.. EPSS estimates a 1.92% chance of exploitation in the next 30 days.
Description
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kde | Kmail | <= 5.3.0 |
References
- http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
- http://www.securityfocus.com/bid/93360Third Party Advisory, VDB Entry
- https://www.kde.org/info/security/advisory-20161006-2.txtVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/10/05/1Third Party Advisory
- http://www.securityfocus.com/bid/93360Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-7967?
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
How severe is CVE-2016-7967?
Severity scoring for CVE-2016-7967 is pending analysis. The EPSS model estimates a 1.92% probability of exploitation in the next 30 days.
How do I fix CVE-2016-7967?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-7958In Wireshark 2.2.0, the NCP dissector could crash, triggered…
- CVE-2016-7959Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly sto…
- CVE-2016-7960Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improp…
- CVE-2016-7964The sendRequest method in HTTPClient Class in file /inc/HTTP…
- CVE-2016-7965DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] inst…
- CVE-2016-7966Through a malicious URL that contained a quote character it …
- CVE-2016-7968KMail since version 5.3.0 used a QWebEngine based viewer tha…
- CVE-2016-7969The wrap_lines_smart function in ass_render.c in libass befo…7.5
- CVE-2016-7970Buffer overflow in the calc_coeff function in libass/ass_blu…
- CVE-2016-7971Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2016-7972The check_allocations function in libass/ass_shaper.c in lib…
- CVE-2016-7973The AppleTalk parser in tcpdump before 4.9.0 has a buffer ov…
Are you affected by CVE-2016-7967?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST