CVE-2016-7966

Severity: high (CVSS 7.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-12-23 · updated 2026-06-17
Weakness: CWE-94

Description

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.

Affected products

Debian Linux: 8.0
Fedoraproject Fedora: 25
KDE Kmail: through 4.4.0
SUSE Linux Enterprise: 12.0

References

http://lists.opensuse.org/opensuse-updates/2016-10/msg00065.html
http://www.debian.org/security/2016/dsa-3697
http://www.openwall.com/lists/oss-security/2016/10/05/1
http://www.securityfocus.com/bid/93360
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNMM5TVPTJQFPJ3YDF4DPXDFW3GQLWLY/
http://lists.opensuse.org/opensuse-updates/2016-10/msg00065.html
http://www.debian.org/security/2016/dsa-3697
http://www.openwall.com/lists/oss-security/2016/10/05/1
http://www.securityfocus.com/bid/93360
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNMM5TVPTJQFPJ3YDF4DPXDFW3GQLWLY/

Get alerted when CVE-2016-7966 or the next vulnerability affects your stack