DSA-3697-1 kdepimlibs - security update

Bulletin has no description...

Kmail JS Code Execution Vulnerability

KMail is a mail client for KDE that supports protocols such as IMAP and POP3. A JS code execution vulnerability exists in Kmail, which can be exploited by an attacker to execute JS code...

Kmail HTML Injection Vulnerability

KMail is a mail client for KDE that supports protocols such as IMAP and POP3. An HTML injection vulnerability exists in Kmail, which can be exploited by an attacker to steal cookie-based authentication credentials...

Ubuntu 12.04 LTS : kdepimlibs vulnerability (USN-3100-1)

Roland Tapken discovered that the KDE-PIM Libraries incorrectly filtered URLs. A remote attacker could use this issue to perform an HTML injection attack in the KMail plain text viewer. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

USN-3100-1: KDE-PIM Libraries vulnerability

Roland Tapken discovered that the KDE-PIM Libraries incorrectly filtered URLs. A remote attacker could use this issue to perform an HTML injection attack in the KMail plain text viewer...

[ASA-201610-5] messagelib: multiple issues

Arch Linux Security Advisory ASA-201610-5 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7967 CVE-2016-7968 Package : messagelib Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package messagel...

[ASA-201610-4] kcoreaddons: insufficient validation

Arch Linux Security Advisory ASA-201610-4 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7966 Package : kcoreaddons Type : insufficient validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kcoreaddons...

CVE-2016-7968

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed...

CVE-2016-7967

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

PT-2016-7449

Name of the Vulnerable Software and Affected Versions KMail affected versions not specified Description The issue allows for HTML code injection in KMail's plaintext viewer through a malicious URL containing a quote character. However, the parser used on the URL limits the injected HTML...

UBUNTU-CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2006-7139

Kmail 1.9.1 on KDE 3.5.2, with "Prefer HTML to Plain Text" enabled, allows remote attackers to cause a denial of service crash via an HTML e-mail with certain table and frameset tags that trigger a segmentation fault, possibly involving invalid free or delete operations...

MGASA-2015-0315 Updated kdepim package fixes security vulnerability

This update fixes a security vulnerability in kdepim : kmail doesn't encrypt attachments when "automatic encryption" is selected CVE-2014-8878...

Updated kdepim package fixes security vulnerability

This update fixes a security vulnerability in kdepim : kmail doesn't encrypt attachments when "automatic encryption" is selected CVE-2014-8878...

PT-2017-6296

Name of the Vulnerable Software and Affected Versions KDE KMail affected versions not specified Description The issue concerns the encryption of attachments in emails. When "automatic encryption" is enabled, KDE KMail fails to encrypt attachments, allowing remote attackers to obtain sensitive...

KMail Attachment Encryption Information Disclosure Vulnerability

Kontact is a software suite of personal information managers and components.KMail is one of the e-mail components. KMail handles attachments that are not properly encrypted, allowing remote attackers to exploit this vulnerability to obtain sensitive information...

openSUSE Security Update : kdebase4-runtime / kdelibs4 / konversation / etc (openSUSE-2015-251)

KDE and QT were updated to fix security issues and bugs. The following vulerabilities were fixed : - CVE-2014-0190: Malformed GIF files could have crashed QT based applications - CVE-2015-0295: Malformed BMP files could have crashed QT based applications - CVE-2014-8600: Multiple cross-site...

MGASA-2014-0432 Updated KDE 4 and related packages move to KDE 4.12.5

This KDE 4 update provides an upgrade to the last stable version of KDE Applications and Development Platform for the 4.12 series, and updates Plasma Workspaces to 4.11.12. This update fixes several security vulnerabilities - KMail/KIO POP3 SSL MITM Flaw CVE-2014-3494 - mga13545 - KAuth PID Reuse...