Kde Kmail
10 CVEs affecting Kde Kmail. Latest disclosed: 2021-08-10. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-7967 | High | 8.1 | 2016-12-23 | KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context b… |
CVE-2017-9604 | High | 7.5 | 2017-06-13 | KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs… |
CVE-2016-7966 | High | 7.3 | 2016-12-23 | Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it… |
CVE-2020-15954 | Medium | 6.5 | 2020-07-27 | KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use. |
CVE-2020-11880 | Medium | 6.5 | 2020-04-17 | An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto… |
CVE-2016-7968 | Medium | 6.5 | 2016-12-23 | KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code wa… |
CVE-2017-17689 | Medium | 5.9 | 2018-05-16 | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
CVE-2014-8878 | Medium | 5.9 | 2017-09-28 | KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniff… |
CVE-2021-38373 | Medium | 5.3 | 2021-08-10 | In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. |
CVE-2019-10732 | Medium | 4.3 | 2019-04-07 | In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |