View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-7966 medium priority: Ubuntu including 4 source packages (kcoreaddons, kdepim, kdepimlibs, kf5-messagelib), 24 status rows across 6 suites (precise, trusty, upstream, xenial, yakkety, zesty): not-affected 10, DNE 5, released 5, needs-triage 2, ignored 1, needed 1.
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.