Homepage

Arbitrary Code Injection Affecting kcoreaddons package, versions <5.26.0-3

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.93% (83rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIAN11-KCOREADDONS-525903
  • published23 Dec 2016
  • disclosed23 Dec 2016
Report a new vulnerability Found a mistake?

Introduced: 23 Dec 2016

CVE-2016-7966  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade Debian:11 kcoreaddons to version 5.26.0-3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kcoreaddons package and not the kcoreaddons package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.