diff --git a/0001-kmail-html-injection-in-plan-text-viewer-cve-2016-7966.patch b/0001-kmail-html-injection-in-plan-text-viewer-cve-2016-7966.patch
new file mode 100644
index 0000000..a7112b9
--- /dev/null
+++ b/0001-kmail-html-injection-in-plan-text-viewer-cve-2016-7966.patch
@@ -0,0 +1,197 @@
+diff --git a/autotests/ktexttohtmltest.cpp b/autotests/ktexttohtmltest.cpp
+index 474f0ca..8fc0c56 100644
+--- a/autotests/ktexttohtmltest.cpp
++++ b/autotests/ktexttohtmltest.cpp
+@@ -30,6 +30,15 @@ QTEST_MAIN(KTextToHTMLTest)
+
+ Q_DECLARE_METATYPE(KTextToHTML::Options)
+
++#ifndef Q_OS_WIN
++void initLocale()
++{
++ setenv("LC_ALL", "en_US.utf-8", 1);
++}
++Q_CONSTRUCTOR_FUNCTION(initLocale)
++#endif
++
++
+ void KTextToHTMLTest::testGetEmailAddress()
+ {
+ // empty input
+@@ -372,6 +381,11 @@ void KTextToHTMLTest::testHtmlConvert_data()
+ QTest::newRow("url-in-parenthesis-3") << "bla (http://www.kde.org - section 5.2)"
+ << KTextToHTML::Options(KTextToHTML::PreserveSpaces)
+ << "bla (http://www.kde.org - section 5.2)";
++
++ // Fix url as foo < > when we concatened them.
++ QTest::newRow("url-with-url") << "foo >"
++ << KTextToHTML::Options(KTextToHTML::PreserveSpaces)
++ << "foo <http://www.kde.org/ <http://www.kde.org/>>";
+ }
+
+
+diff --git a/src/lib/text/ktexttohtml.cpp b/src/lib/text/ktexttohtml.cpp
+index b5e1bda..c70d062 100644
+--- a/src/lib/text/ktexttohtml.cpp
++++ b/src/lib/text/ktexttohtml.cpp
+@@ -228,11 +228,19 @@ QString KTextToHTMLHelper::getUrl()
+
+ url.reserve(mMaxUrlLen); // avoid allocs
+ int start = mPos;
++ bool previousCharIsSpace = false;
+ while ((mPos < mText.length()) &&
+ (mText[mPos].isPrint() || mText[mPos].isSpace()) &&
+ ((afterUrl.isNull() && !mText[mPos].isSpace()) ||
+ (!afterUrl.isNull() && mText[mPos] != afterUrl))) {
+- if (!mText[mPos].isSpace()) { // skip whitespace
++ if (mText[mPos].isSpace()) {
++ previousCharIsSpace = true;
++ } else { // skip whitespace
++ if (previousCharIsSpace && mText[mPos] == QLatin1Char('<')) {
++ url.append(QLatin1Char(' '));
++ break;
++ }
++ previousCharIsSpace = false;
+ url.append(mText[mPos]);
+ if (url.length() > mMaxUrlLen) {
+ break;
+@@ -267,7 +275,6 @@ QString KTextToHTMLHelper::getUrl()
+ }
+ } while (url.length() > 1);
+ }
+-
+ return url;
+ }
+
+@@ -334,6 +341,7 @@ QString KTextToHTML::convertToHtml(const QString &plainText, const KTextToHTML::
+ QChar ch;
+ int x;
+ bool startOfLine = true;
++ //qDebug()<<" plainText"<parseEmoticons(result, true, exclude);
+ }
++ //qDebug()<<" result "<>"
+ << KTextToHTML::Options(KTextToHTML::PreserveSpaces)
+ << "foo <http://www.kde.org/ <http://www.kde.org/>>";
++
++ //Fix url exploit
++ QTest::newRow("url-exec-html") << "https://\">