CVE-2012-3413

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-07 · updated 2026-06-16
Weakness: CWE-16

Description

The HTMLQuoteColorer::process function in messageviewer/htmlquotecolorer.cpp in KDE PIM 4.6 through 4.8 does not disable JavaScript, Java, and Plugins, which allows remote attackers to inject arbitrary web script or HTML via a crafted email.

Affected products

Kde Pim: 4.6, 4.8

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083946.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084262.html
http://secunia.com/advisories/50008
http://ubuntu.com/usn/usn-1512-1
http://www.openwall.com/lists/oss-security/2012/07/13/3
http://www.openwall.com/lists/oss-security/2012/07/13/4
http://www.openwall.com/lists/oss-security/2012/07/16/3
http://www.openwall.com/lists/oss-security/2012/07/17/11
https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72f4745e00f53031965a9c10b2d6862bd54
http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083946.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-July/084262.html
http://secunia.com/advisories/50008

Get alerted when CVE-2012-3413 or the next vulnerability affects your stack