CVE-2016-7966 Cross-site scripting in n/a
An attacker can inject HTML into KMail's plaintext viewer via a malicious URL, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7966?
CVE-2016-7966 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 23 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Weakness: CWE-94
Which versions are affected by CVE-2016-7966?
It affects 4 products.
Linux distribution packages (2)
kcoreaddons SUSE:Package Hub 12 SP1 | All versions | 5.20.0-6.1 |
kcoreaddons SUSE:Package Hub 12 SP1 | All versions | 5.20.0-6.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Kde Kmail, Suse Linux Enterprise.
How do I fix CVE-2016-7966?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2016-7966 being exploited?
There is no known exploitation of CVE-2016-7966 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-7966, DLA-673-1, DSA-3697-1, GHSA-833g-vcgj-6xrj, UBUNTU-CVE-2016-7966, openSUSE-SU-2016:2558-1 and 2 more.