PatchTheCVEkmail vulnerabilities and fixes
Recent CVEs affecting kmail, with upgrade or downgrade steps. 12 tracked.
kmail has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2021-08-10. Highest priority: CVE-2016-7966 (score 56/100).
- CVE-2021-38373 MEDIUM 5.3 DOWNGRADE In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) u
- CVE-2020-15954 MEDIUM 6.5 DOWNGRADE MITIGATE KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates th
- CVE-2020-11880 MEDIUM 6.5 UPGRADE An issue was discovered in KDE KMail before 19.12.3
- CVE-2019-10732 MEDIUM 4.3 DOWNGRADE MITIGATE In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts wit
- CVE-2017-9604 HIGH 7.5 UPGRADE UPGRADE KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not
- CVE-2016-7968 MEDIUM 6.5 UPGRADE KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
- CVE-2016-7967 HIGH 8.1 UPGRADE KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
- CVE-2016-7966 HIGH 7.3 UPGRADE MITIGATE Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint
- CVE-2014-8878 MEDIUM 5.9 DOWNGRADE KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote a
- CVE-2006-7062 HIGH 7.8 UPGRADE calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path
- CVE-2006-2104 MEDIUM 6.8 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow rem
- CVE-2005-0404 MEDIUM 5.0 DOWNGRADE MITIGATE KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has bee
FAQ
How do I fix kmail vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is kmail being exploited right now?
None of the tracked kmail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which kmail CVE should I patch first?
CVE-2016-7966 currently ranks highest (56/100): Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint.