CVE-2016-7966
Through a malicious URL that contained a quote character it was possible to inject HTML code in...
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
CVE-2016-7966- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
CVE-2016-7966- Updated
- 2026-11-02
EUVDEUVD-2016-8814 No score
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
EUVD-2016-8814- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-833g-vcgj-6xrj
Through a malicious URL that contained a quote character it was possible to inject HTML code in...
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
GHSA-833g-vcgj-6xrj- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
CVE-2016-7966- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-7966
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
DEBIAN-CVE-2016-7966- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-7966
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
- Record
UBUNTU-CVE-2016-7966- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2016:2558-1 No score
Security update for kcoreaddons
This update for kcoreaddons fixes the following issues:
- CVE-2016-7966: HTML injection in plain text viewer (boo#1002977)
- Record
openSUSE-SU-2016:2558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2016:2559-1 No score
Security update for kcoreaddons
This update for kcoreaddons fixes the following issues:
- CVE-2016-7966: HTML injection in plain text viewer (boo#1002977)
- Record
openSUSE-SU-2016:2559-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10509-1 No score
kcoreaddons-5.29.0-1.1 on GA media
These are all security issues fixed in the kcoreaddons-5.29.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10509-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kcoreaddonsDebian:12 |
before 5.26.0-3 | 5.26.0-3 |
kcoreaddonsDebian:13 |
before 5.26.0-3 | 5.26.0-3 |
kcoreaddonsDebian:14 |
before 5.26.0-3 | 5.26.0-3 |
kdepimlibsDebian:7 |
before 4:4.8.4-2+deb7u1, plus listed versions 4:4.8.4-2 |
4:4.8.4-2+deb7u1 |
kdepimlibsDebian:8 |
before 4:4.14.2-2+deb8u2, plus listed versions 4:4.14.2-24:4.14.2-2+deb8u1 |
4:4.14.2-2+deb8u2 |
kdepimlibsUbuntu:14.04:LTS |
before 4:4.13.3-0ubuntu0.4, plus listed versions 4:4.11.2-0ubuntu14:4.11.2-0ubuntu24:4.11.80-0ubuntu14:4.11.95-0ubuntu14:4.11.97-0ubuntu1 Show 14 moreShow less4:4.12.0-0ubuntu14:4.12.1-0ubuntu14:4.12.2-0ubuntu14:4.12.2-0ubuntu24:4.12.3-0ubuntu14:4.12.90-0ubuntu24:4.12.95-0ubuntu14:4.12.97-0ubuntu14:4.13.0-0ubuntu14:4.13.1-0ubuntu0.14:4.13.2-0ubuntu0.14:4.13.3-0ubuntu0.14:4.13.3-0ubuntu0.24:4.13.3-0ubuntu0.3 |
4:4.13.3-0ubuntu0.4 |
kcoreaddonsUbuntu:16.04:LTS |
before 5.18.0-0ubuntu1.1, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.18.0-0ubuntu1 |
5.18.0-0ubuntu1.1 |
kcoreaddonsSUSE:Package Hub 12 SP1 |
before 5.20.0-6.1 | 5.20.0-6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-7966 is a high vulnerability (CVSS 7.3) in Kde Kmail, published October 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. Fixed in kcoreaddons 5.26.0-3.
References
securityfocus.com/bid/93360
openwall.com/lists/oss-security/2016/10/05/1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNMM5TVPTJQFPJ3YDF4DPXDFW3GQLWLY
lists.opensuse.org/opensuse-updates/2016-10/msg00065.html
debian.org/security/2016/dsa-3697
nvd.nist.gov/vuln/detail/CVE-2016-7966
Show 9 moreShow less
github.com/advisories/GHSA-833g-vcgj-6xrj
security-tracker.debian.org/tracker/CVE-2016-7966
ubuntu.com/security/CVE-2016-7966
kde.org/info/security/advisory-20161006-1.txt
cve.org/CVERecord?id=CVE-2016-7966
bugzilla.suse.com/1002977
suse.com/security/cve/CVE-2016-7966