Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Arch Linux Advisory 201610-4: kcoreaddons Medium Severity Validation Issue

Calendar Oct 07, 2016 • User Avatar LinuxSecurity Advisories
1 min read
Archlinux Large Esm H446
Topics%20covered

Topics Covered

security advisory remote code execution medium severity insufficient validation arch linux kcoreaddons
The package kcoreaddons before version 5.26.0-2 is vulnerable to insufficient validation. 
Arch Linux Security Advisory ASA-201610-4
========================================
Severity: Medium
Date    : 2016-10-07
CVE-ID  : CVE-2016-7966
Package : kcoreaddons
Type    : insufficient validation
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package kcoreaddons before version 5.26.0-2 is vulnerable to
insufficient validation.

Resolution
=========
Upgrade to 5.26.0-2.

# pacman -Syu "kcoreaddons>=5.26.0-2"

The problem has been fixed upstream but no release is available yet.

Workaround
=========
None.

Description
==========
Through a malicious URL that contained a quote character it was
possible to inject HTML code in KMail's plain text viewer. Due to the
parser used on the URL it was not possible to include the equal sign
(=) or a space into the injected HTML, which greatly reduces the
available HTML functionality. Although it is possible to include an
HTML comment indicator to hide content.

Impact
=====
A remote attacker is able to inject HTML code in KMail's plain text
viewer.

References
=========
https://kde.org/info/security/advisory-20161006-1.txt
https://seclists.org/oss-sec/2016/q4/23
https://access.redhat.com/security/cve/CVE-2016-7966