Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 436
Alerts This Week
Warning Icon 1 436

Ubuntu: USN-5340-1 Critical: CKEditor Code Execution Risks

ubuntu
Calendar Grey March 22, 2022
Dist Ubuntu Esm H88
Several vulnerabilities in CKEditor addressed in various Ubuntu releases, including risks of possible remote code execution.
Several security issues were fixed in CKEditor.

Summary

Several security issues were fixed in CKEditor.

Software Description:

- ckeditor: text editor which can be embedded into web pages

Details:

Kyaw Min Thein discovered that CKEditor incorrectly handled

certain inputs. An attacker could possibly use this issue

to execute arbitrary code. This issue only affects

Ubuntu 18.04 LTS. (CVE-2018-9861)

Micha Bentkowski discovered that CKEditor incorrectly handled

certain inputs. An attacker could possibly use this issue to

execute arbitrary code. This issue only affects

Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)

Anton Subbotin discovered that CKEditor incorrectly handled

certain inputs. An attacker could possibly use this issue to

execute arbitrary code. This issue only affects

Ubuntu 21.10. (CVE-2021-32808)

Anton Subbotin discovered that CKEditor incorrectly handled

certain inputs. An attacker could possibly use this issue to

inject arbitrary code. (CVE-2021-32809)

Or Sahar discovered that CKEdito...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory code execution ubuntu ckeditor risk fix

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
ckeditor 4.16.0+dfsg-2ubuntu0.1

Ubuntu 20.04 LTS:
ckeditor 4.12.1+dfsg-1ubuntu0.1

Ubuntu 18.04 LTS:
ckeditor 4.5.7+dfsg-2ubuntu0.18.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5340-1

CVE-2018-9861, CVE-2020-9281, CVE-2021-32808, CVE-2021-32809,

CVE-2021-33829, CVE-2021-37695

Severity
critical
Lowest
Low
Medium
High
Critical

March 22, 2022

Topics%20covered

Topics Covered

security advisory code execution ubuntu ckeditor risk fix

Package Information

https://launchpad.net/ubuntu/+source/ckeditor/4.16.0+dfsg-2ubuntu0.1
https://launchpad.net/ubuntu/+source/ckeditor/4.12.1+dfsg-1ubuntu0.1
https://launchpad.net/ubuntu/+source/ckeditor/4.5.7+dfsg-2ubuntu0.18.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.