vendor:
KMail
by:
Unknown
5.5
CVSS
MEDIUM
Arbitrary Content Injection
CWE
Product Name: KMail
Affected Version From: KMail versions prior to and including 1.9.5
Affected Version To: KMail versions prior to and including 1.9.5
Patch Exists: NO
Related CWE:
CPE: a:kde:kmail:1.9.5
Platforms Tested:
Unknown
Arbitrary Content Injection in KMail
The vulnerability allows an attacker to add arbitrary content into a GnuPG signed and/or encrypted message without the end user knowing. This vulnerability is due to the weakness discussed in BID 22757 (GnuPG Signed Message Arbitrary Content Injection Weakness) and has been assigned its own BID because of the specific way that KMail uses GnuPG.
Mitigation:
Upgrade to KMail version 1.9.6 or later.
