USN-3100-1: KDE-PIM Libraries vulnerability

12 October 2016

kdepimlibs vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.04 LTS

Summary

KMail could be made to run HTML if it opened a specially crafted email.

Software Description

  • kdepimlibs - the KDE PIM libraries

Details

Roland Tapken discovered that the KDE-PIM Libraries incorrectly filtered URLs. A remote attacker could use this issue to perform an HTML injection attack in the KMail plain text viewer.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS
libkpimutils4 - 4:4.8.5-0ubuntu0.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart KMail to make all the necessary changes.

References