kcoreaddons: HTML injection
| Package(s): | kcoreaddons |
CVE #(s): | CVE-2016-7966
|
| Created: | October 10, 2016 |
Updated: | October 24, 2016 |
| Description: |
From the Arch Linux advisory:
Through a malicious URL that contained a quote character it was
possible to inject HTML code in KMail's plain text viewer. Due to the
parser used on the URL it was not possible to include the equal sign
(=) or a space into the injected HTML, which greatly reduces the
available HTML functionality. Although it is possible to include an
HTML comment indicator to hide content. |
| Alerts: |
|
