What is CVE-2016-7967?

CVE-2016-7967 is a high-severity vulnerability in Kde Kmail, classified under Code Injection. CVSS score: 8.1/10. Published 2016-12-23.

How severe is CVE-2016-7967?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Kde Kmail

CVE-2016-7967

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

Affected products

Kde Kmail
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (mailing-list, x_refsource_MLIST, Third Party Advisory)
nvd@nist.gov (Vendor Advisory)

Frequently asked questions

What is CVE-2016-7967?: CVE-2016-7967 is a high-severity vulnerability in Kde Kmail, classified under Code Injection. CVSS score: 8.1/10. Published 2016-12-23.
How severe is CVE-2016-7967?: High severity. CVSS v3 base score is 8.1 out of 10.