Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
172
security advisorysoftware patchcross site scriptingUbuntu 24.10: USN-7258-1 critical: ckeditor cross site scripting
Several security issues were fixed in CKEditor.. ========================================================================== Ubuntu Security Notice USN-7258-1 February 06, 2025 ckeditor vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in CKEditor. Software Description: - ckeditor: Text editor which can be embedded into web pages Details: Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728) It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439) It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815, CVE-2024-24816) It was discovered that CKEditor did not properly sanitize version notifications. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 ckeditor 4.22.1+dfsg1-2ubuntu0.24.10.1 Ubuntu 24.04 LTS ckeditor 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS ckeditor 4.16.2+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS ckeditor 4.12.1+dfsg-1ubuntu0.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS ckeditor 4.5.7+dfsg-2ubuntu0.18.04.1+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS ckeditor 4.5.7+dfsg-2ubuntu0.16.04.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7258-1 CVE-2022-24728, CVE-2023-28439, CVE-2024-24815, CVE-2024-24816, CVE-2024-43411 Package Information: https://launchpad.net/ubuntu/+source/ckeditor/4.22.1+dfsg1-2ubuntu0.24.10.1 . Multiple vulnerabilities have been addressed in CKEditor impacting various Ubuntu releases. Ensure you remain informed for enhanced security.. ckeditor security update, Ubuntu patches, web editor vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Feb 06, 2025
•Critical
Ubuntu
89
security advisorycriticalsoftware updateFedora 39 CKEditor 4.22.1 Critical Advisory: GHSA-vh5c-xwqv-cv9g
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-426b3a500d 2023-11-03 18:20:20.950662 -------------------------------------------------------------------------------- Name : ckeditor Product : Fedora 39 Version : 4.22.1 Release : 1.fc39 URL : https://ckeditor.com/ Summary : WYSIWYG text editor to be used inside web pages Description : CKEditor is a text editor to be used inside web pages. It's a WYSIWYG editor, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common editing features found on desktop editing applications like Microsoft Word and OpenOffice. -------------------------------------------------------------------------------- Update Information: - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1) - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0) - [GHSA- vh5c-xwqv-cv9g / CVE-2023-28439](- vh5c-xwqv-cv9g) - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2) - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1) -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 26 2023 Shawn Iwinski - 4.22.1-1 - Update to 4.22.1 (RHBZ #2149680) - GHSA-vh5c-xwqv-cv9g / CVE-2023-28439 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2149680 - ckeditor-4.22.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2149680 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-426b3a500d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPGkey. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 03, 2023
•Critical
Fedora
89
security advisorymoderatesecurity issueFedora 38: 2023-79b5902a52 Moderate: CKEditor 4.22.1 Security Advisory
- [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1) - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0) - [GHSA- vh5c-xwqv-cv9g / CVE-2023-28439](- vh5c-xwqv-cv9g) - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2) -. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-79b5902a52 2023-10-04 15:50:14.488593 -------------------------------------------------------------------------------- Name : ckeditor Product : Fedora 38 Version : 4.22.1 Release : 1.fc38 URL : https://ckeditor.com/ Summary : WYSIWYG text editor to be used inside web pages Description : CKEditor is a text editor to be used inside web pages. It's a WYSIWYG editor, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common editing features found on desktop editing applications like Microsoft Word and OpenOffice. -------------------------------------------------------------------------------- Update Information: - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1) - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0) - [GHSA- vh5c-xwqv-cv9g / CVE-2023-28439](- vh5c-xwqv-cv9g) - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2) - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1) -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 26 2023 Shawn Iwinski - 4.22.1-1 - Update to 4.22.1 (RHBZ #2149680) - GHSA-vh5c-xwqv-cv9g / CVE-2023-28439 * Wed Jul 19 2023 Fedora Release Engineering - 4.20.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2149680 - ckeditor-4.22.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2149680 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-79b5902a52' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 04, 2023
•Important
Fedora
89
security advisoryhigh severitysecurity issueFedora 37: 2023-983ff03630 High: CKEditor Security Update
- [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1) - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0) - [GHSA- vh5c-xwqv-cv9g / CVE-2023-28439](- vh5c-xwqv-cv9g) - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2) -. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-983ff03630 2023-10-04 15:47:53.759449 -------------------------------------------------------------------------------- Name : ckeditor Product : Fedora 37 Version : 4.22.1 Release : 1.fc37 URL : https://ckeditor.com/ Summary : WYSIWYG text editor to be used inside web pages Description : CKEditor is a text editor to be used inside web pages. It's a WYSIWYG editor, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common editing features found on desktop editing applications like Microsoft Word and OpenOffice. -------------------------------------------------------------------------------- Update Information: - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1) - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0) - [GHSA- vh5c-xwqv-cv9g / CVE-2023-28439](- vh5c-xwqv-cv9g) - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2) - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1) -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 26 2023 Shawn Iwinski - 4.22.1-1 - Update to 4.22.1 (RHBZ #2149680) - GHSA-vh5c-xwqv-cv9g / CVE-2023-28439 * Wed Jul 19 2023 Fedora Release Engineering - 4.20.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jan 18 2023 Fedora Release Engineering - 4.20.0-2 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2149680 - ckeditor-4.22.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2149680 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-983ff03630' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 04, 2023
Fedora
89
security advisoryFedoraXSSFedora 37: CKEditor 4.20 Security Update Critical: XSS Issues
--------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-4c634ee466 2022-11-10 22:04:44.630479 --------------------------------------------------------------------------------Name : ckeditor Product : Fedora 37 Version : 4.20.0 Release : 1.fc37 URL : https://ckeditor.com/ Summary : WYSIWYG text editor to be used inside web pages Description : CKEditor is a text editor to be used inside web pages. It's a WYSIWYG editor, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common editing features found on desktop editing applications like Microsoft Word and OpenOffice. --------------------------------------------------------------------------------Update Information: ## CKEditor 4.20 New Features: * [#5084](https://github.com/ckeditor/ckeditor4/issues/5084): Added the [`config.t abletools_scopedHeaders`](https://ckeditor.com/docs/404.html) configuration option controlling the behaviour of table headers with and without the `[scope]` attribute. * [#5219](https://github.com/ckeditor/ckeditor4/issues/5219): Added the [`config.image2_defaultLockRatio`](https://ckeditor.com/docs/404.html _config.html#cfg-image2_defaultLockRatio) configuration option allowing to setthe default value of the "Lock ratio" option in the [Enhanced Image](https://ckeditor.com/cke4/addon/image2) dialog. * [#2008](https://github.com/ckeditor/ckeditor4/issues/2008): Extended the [Mentions](https://ckeditor.com/cke4/addon/mentions) and [Emoji](https://ckeditor.com/cke4/addon/emoji) plugins with a feature option that adds a space after an accepted autocompletion match. See: * [`configDefinition.followingSpace`](https://ckeditor.com/docs/404.html ITOR_plugins_mentions_configDefinition.html#property-followingSpace) option for the mentions plugin, and *[`config.emoji_followingSpace`](tor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-emoji_followingSpace) option for the emoji plugin. * [#5215](https://github.com/ckeditor/ckeditor4/issues/5215): Added the [`config.coreStyles_toggleSubSup`](https://ckeditor.com/docs/404.html) configuration option which disallows setting the subscript and superscript on the same element simultaneously using UI buttons. This option is turned off by default. Fixed Issues: * [#4889](https://github.com/ckeditor/ckeditor4/issues/4889): Fixed: Incorrect position of the [Table Resize](https://ckeditor.com/cke4/addon/tableresize) cursor after scrolling the editor horizontally. * [#5319](https://github.com/ckeditor/ckeditor4/issues/5319): Fixed: [Autolink](https://ckeditor.com/cke4/addon/autolink) [`config.autolink_urlRegex`](https://ckeditor.com/docs/404.html) option produced invalid links when configured directly using the editor instance config. Thanks to [Aigars Zeiza](https://github.com/Zuzon)! * [#4941](https://github.com/ckeditor/ckeditor4/issues/4941): Fixed: Some entities got wrongly encoded when using [`entities_processNumerical true`](https://ckeditor.com/docs/404.html) configuration option. * [#4931](https://github.com/ckeditor/ckeditor4/issues/4931): Fixed: Selecting the whole editor content when there is only a list with an empty element at the end inside and deleting it did not delete all list items. API changes: * [#5122](https://github.com/ckeditor/ckeditor4/issues/5122): Added the ability to provide a list of buttons as an array to the [`config.removeButtons`](https://ckeditor.com/docs/404.html) config variable. * [#2008](https://github.com/ckeditor/ckeditor4/issues/2008): Added [Autocomplete](https://ckeditor.com/cke4/addon/autocomplete) [`followingSp ace`](https://ckeditor.com/docs/404.html) option that finishes an accepted match with a space. ## CKEditor 4.19.1 Fixed Issues: * [#5125](https://github.com/ckeditor/ckeditor4/issues/5125): Fixed: Deleting a widget with disabled[autoParagraph](https://ckeditor.com/docs/404.html) by the keyboard `backspace` key removes the editor editable area and crashes the editor. * [#5135](https://github.com/ckeditor/ckeditor4/issues/5135): Fixed: The [`checkbo x.setValue`](https://ckeditor.com/docs/404.html) and [`radio.setValue`](https://ckeditor.com/docs/404.html keditor4/latest/api/CKEDITOR_ui_dialog_radio.html#method-setValue) methods are not chainable as stated in the documentation. Thanks to [Jordan Bradford](https://github.com/LordPachelbel)! * [#5085](https://github.com/ckeditor/ckeditor4/issues/5085): Fixed: The [Language](https://ckeditor.com/cke4/addon/language) plugin removes the element marking the text in foreign language if said element does not have an information about the text direction. * [#4284](https://github.com/ckeditor/ckeditor4/issues/4284): Fixed: [Tableselection](https://ckeditor.com/cke4/addon/tableselection) Merging cells with a rowspan throws an unexpected error and does not create an undo step. * [#5184](https://github.com/ckeditor/ckeditor4/issues/5184): Fixed: The [Editor Placeholder](https://ckeditor.com/cke4/addon/wysiwygarea) plugin degrades typing performance. * [#5158](https://github.com/ckeditor/ckeditor4/issues/5158): Fixed: [`CKEDITOR.tools#convertToPx()`](https://ckeditor.com/docs/404.html) gives invalid results if the helper calculator element was deleted from the DOM. * [#5234](https://github.com/ckeditor/ckeditor4/issues/5234): Fixed: [Easy Image](https://ckeditor.com/cke4/addon/easyimage) doesn't allow to upload images files using toolbar button. * [#438](https://github.com/ckeditor/ckeditor4/issues/438): Fixed: It is impossible to navigate to the [elementspath](https://ckeditor.com/cke4/addon/elementspath) from the [toolbar](https://ckeditor.com/cke4/addon/toolbar) by keyboard and vice versa. * [#4449](https://github.com/ckeditor/ckeditor4/issues/4449): Fixed: [`dialog.vali date#functions`](https://ckeditor.com/docs/404.html#method-functions) incorrectly composes functionsthat return an optional error message, like e.g. [`dialog.validate.number`](https://ckeditor.com/docs/404.html#method-number) due to unnecessary return type coercion. * [#4473](https://github.com/ckeditor/ckeditor4/issues/4473): Fixed: The [dialog.v alidate](https://ckeditor.com/docs/404.html) method does not accept parameter value. The issue originated in [dialog.v alidate.functions](https://ckeditor.com/docs/404.html#method-functions) method that did not properly propagate parameter value to validator. Affected validators: * [`functions`](https://ckeditor.com/docs/404.html#method-functions) * [`equals`](https://ckeditor.com/docs/404.html#method-equals) * [`notEqual`](tor.com/docs/ckeditor4/latest/api/CKEDITOR_dialog_validate.html#method-notEqual) * [`cssLength`](https://ckeditor.com/docs/404.html#method-cssLength) * [`htmlLength`](s/ckeditor4/latest/api/CKEDITOR_dialog_validate.html#method-htmlLength) * [`inlineStyle`](https://ckeditor.com/docs/404.html#method-inlineStyle) * [#5147](https://github.com/ckeditor/ckeditor4/issues/5147): Fixed: The [Accessibility Help](https://ckeditor.com/cke4/addon/a11yhelp) dialog does not contain info about focus being moved back to the editing area upon leaving dialogs. * [#5144](https://github.com/ckeditor/ckeditor4/issues/5144): Fixed: [Menu buttons](https://ckeditor.com/cke4/addon/menubutton) and [panel buttons](https://ckeditor.com/cke4/addon/panelbutton) incorrectly indicate the open status of their associated pop-up menus in the browser's accessibility tree. * [#5022](https://github.com/ckeditor/ckeditor4/issues/5022): Fixed: [Find and Replace](https://ckeditor.com/cke4/addon/find) does not respond to the `Enter` key. API changes: * [#5184](https://github.com/ckeditor/ckeditor4/issues/5184): Added the [`config.e ditorplaceholder_delay`](https://ckeditor.com/docs/404.html) configuration option allowing to delay placeholder before it is toggled when changing editor content.* [#5184](https://github.com/ckeditor/ckeditor4/issues/5184): Added the [`CKEDITOR.tools#debounce()`](https://ckeditor.com/docs/404.html) function allowing to postpone a passed function execution until the given milliseconds have elapsed since the last time it was invoked. ## CKEditor 4.19.0 New features: * [#2444](https://github.com/ckeditor/ckeditor4/issues/2444): Togglable toolbar buttons are now exposed as toggle buttons in the browser's accessibility tree. * [#4641](https://github.com/ckeditor/ckeditor4/issues/4641): Added an option allowing to cancel the [Delayed Editor Creation](https://ckeditor.com/docs/404.html) feature as a function handle for editor creators ([`CKEDITOR.replace`](https://ckeditor.com/docs/404.html), [`CKEDITOR.inline`](s/ckeditor4/latest/api/CKEDITOR.html#method-inline), [`CKEDITOR.appendTo`](https://ckeditor.com/docs/404.html). * [#4986](https://github.com/ckeditor/ckeditor4/issues/4986): Added [`config.shift LineBreaks`](https://ckeditor.com/docs/404.html) allowing to preserve inline elements formatting when the `shift`+`enter` keystroke is used. * [#2445](https://github.com/ckeditor/ckeditor4/issues/2445): Added [`config.applicationTitle`](https://ckeditor.com/docs/404.html) configuration option allowing to customize or disable the editor's application region label. This option, combined with [`config.title `](https://ckeditor.com/docs/404.html), gives much better control over the editor's labels read by screen readers. Fixed Issues: * [#4543](https://github.com/ckeditor/ckeditor4/issues/4543): Fixed: Toolbar buttons toggle state is not correctly announced by screen readers lacking the information whether the feature is on or off. * [#4052](https://github.com/ckeditor/ckeditor4/issues/4052): Fixed: Editor labels are read incorrectly by screen readers due to invalid editor control type for the [Iframe Editing Area](https://ckeditor.com/cke4/addon/wysiwygarea) editors. * [#1904](https://github.com/ckeditor/ckeditor4/issues/1904): Fixed: Screen readers arenot announcing the read-only editor state. * [#4904](https://github.com/ckeditor/ckeditor4/issues/4904): Fixed: Table cell selection and navigation with the `tab` key behavior is inconsistent after adding a new row. * [#3394](https://github.com/ckeditor/ckeditor4/issues/3394): Fixed: [Enhanced image](https://ckeditor.com/cke4/addon/image2) plugin dialog is not supporting URL with query string parameters. Thanks to [Simon Urli](https://github.com/surli)! * [#5049](https://github.com/ckeditor/ckeditor4/issues/5049): Fixed: The editor fails in strict mode due to not following the `use strict` directives in a core editor module. * [#5095](https://github.com/ckeditor/ckeditor4/issues/5095): Fixed: The [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin shows notification about unsupported file format when the file type is different than `jpg`, `gif`, `png`, not respecting [supported types](https://ckeditor.com/docs/404.html) by the [Upload Widget](https://ckeditor.com/cke4/addon/uploadwidget) plugin. * [#4855](https://github.com/ckeditor/ckeditor4/issues/4855): [iOS] Fixed: Focusing toolbar buttons with an enabled VoiceOver screen reader moves the browser focus into an editable area and interrupts button functionality. API changes: * [#4641](https://github.com/ckeditor/ckeditor4/issues/4641): The [`CK EDITOR.replace`](https://ckeditor.com/docs/404.html), [`CKEDITOR.inline`](https://ckeditor.com/docs/404.html), [`CKEDITOR.appendTo`](https://ckeditor.com/docs/404.html functions are now returning a handle function allowing to cancel the [Delayed Editor Creation](https://ckeditor.com/docs/404.html) feature. * [#5095](https://github.com/ckeditor/ckeditor4/issues/5095): Added the [CKEDITOR. plugins.clipboard.addFileMatcher](https://ckeditor.com/docs/404.html) function allowing to define file formats supported by the [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin. Trying to paste unsupported files will result in a notification that a file cannot be dropped or pasted intothe editor. * [#2445](https://github.com/ckeditor/ckeditor4/issues/2445): Added [`config.appli cationTitle`](https://ckeditor.com/docs/404.html) alongside [`CKEDITOR.editor#applicationTitle`](https://ckeditor.com/docs/404.html) to allow customizing editor's application region label. ## CKEditor 4.18.0 **Security Updates:** * Fixed an XSS vulnerability in the core module reported by GitHub Security Lab team member [Kevin Backhouse](https://github.com/kevinbackhouse). Issue summary: The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing a JavaScript code. See [CVE-2022-24728](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89) for more details. * Fixed a Regular expression Denial of Service (ReDoS) vulnerability in dialog plugin discovered by the CKEditor 4 team during our regular security audit. Issue summary: The vulnerability allowed to abuse a dialog input validator regular expression, which could cause a significant performance drop resulting in a browser tab freeze. See [CVE-2022-24729](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh) for more details. You can read more details in the relevant security advisory and [contact us](
Nov 10, 2022
•Critical
Fedora
89
security advisoryFedorackeditorFedora 36: FEDORA-2022-b61dfd219b moderate: CKEditor 4.20 Features
## CKEditor 4.20 New Features: * [#5084](https://github.com/ckeditor/ckeditor4/issues/5084): Added the [`config.t abletools_scopedHeaders`](https://ckeditor.com/docs/404.html R_config.html#cfg-tabletools_scopedHeaders) configuration option controlling the behaviour of table headers with and without the `[scope]` attribute. * . -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2022-b61dfd219b 2022-10-23 09:02:48.673508 -------------------------------------------------------------------------------- Name : ckeditor Product : Fedora 36 Version : 4.20.0 Release : 1.fc36 URL : https://ckeditor.com/ Summary : WYSIWYG text editor to be used inside web pages Description : CKEditor is a text editor to be used inside web pages. It's a WYSIWYG editor, which means that the text being edited on it looks as similar as possible to the results users have when publishing it. It brings to the web common editing features found on desktop editing applications like Microsoft Word and OpenOffice. -------------------------------------------------------------------------------- Update Information: ## CKEditor 4.20 New Features: * [#5084](https://github.com/ckeditor/ckeditor4/issues/5084): Added the [`config.t abletools_scopedHeaders`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-tabletools_scopedHeaders) configuration option controlling the behaviour of table headers with and without the `[scope]` attribute. * [#5219](https://github.com/ckeditor/ckeditor4/issues/5219): Added the [`config.image2_defaultLockRatio`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-image2_defaultLockRatio) configuration option allowing to set the default value of the "Lock ratio" option in the [Enhanced Image](https://ckeditor.com/cke4/addon/image2) dialog. * [#2008](https://github.com/ckeditor/ckeditor4/issues/2008): Extendedthe [Mentions](https://ckeditor.com/cke4/addon/mentions) and [Emoji](https://ckeditor.com/cke4/addon/emoji) plugins with a feature option that adds a space after an accepted autocompletion match. See: * [`confi gDefinition.followingSpace`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_plugins_mentions_configDefinition.html#property-followingSpace) option for the mentions plugin, and * [`config.emoji_followingSpace`](https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_config.html#cfg-emoji_followingSpace) option for the emoji plugin. * . Fedora 36 brings an improved CKEditor with exciting features and settings, offering better tools for advanced web content creation.. ckeditor features,Fedora update,WYSIWYG text editor,web editing,configuration options. . LinuxSecurity.com Team
Oct 23, 2022
Fedora
172
security advisorycode executionubuntuUbuntu: USN-5340-1 Critical: CKEditor Code Execution Risks
Several security issues were fixed in CKEditor.. =========================================================================Ubuntu Security Notice USN-5340-1 March 22, 2022 ckeditor vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in CKEditor. Software Description: - ckeditor: text editor which can be embedded into web pages Details: Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861) Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281) Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808) Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809) Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829) Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: ckeditor 4.16.0+dfsg-2ubuntu0.1 Ubuntu 20.04 LTS: ckeditor 4.12.1+dfsg-1ubuntu0.1 Ubuntu 18.04 LTS: ckeditor4.5.7+dfsg-2ubuntu0.18.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5340-1 CVE-2018-9861, CVE-2020-9281, CVE-2021-32808, CVE-2021-32809, CVE-2021-33829, CVE-2021-37695 Package Information: https://launchpad.net/ubuntu/+source/ckeditor/4.16.0+dfsg-2ubuntu0.1 https://launchpad.net/ubuntu/+source/ckeditor/4.12.1+dfsg-1ubuntu0.1 https://launchpad.net/ubuntu/+source/ckeditor/4.5.7+dfsg-2ubuntu0.18.04.1 . Several vulnerabilities in CKEditor addressed in various Ubuntu releases, including risks of possible remote code execution.. CKEditor Exploit, Ubuntu Security Update, Code Injection Fixes. . Severity: Critical. LinuxSecurity.com Team
Mar 22, 2022
•Critical
Ubuntu
197
security advisorycriticalXSSDebian 9 DLA-2813-1 Critical: CKEditor XSS Threat Update
CKEditor, an open source WYSIWYG HTML editor with rich content support, which can be embedded into web pages, had two vulnerabilites as follows: . - ----------------------------------------------------------------------- Debian LTS Advisory DLA-2813-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Utkarsh Gupta November 09, 2021 https://wiki.debian.org/LTS - ----------------------------------------------------------------------- Package : ckeditor Version : 4.5.7+dfsg-2+deb9u1 CVE ID : CVE-2021-33829 CVE-2021-37695 Debian Bug : 992290 CKEditor, an open source WYSIWYG HTML editor with rich content support, which can be embedded into web pages, had two vulnerabilites as follows: CVE-2021-33829 A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. CVE-2021-37695 A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. For Debian 9 stretch, these problems have been fixed in version 4.5.7+dfsg-2+deb9u1. We recommend that you upgrade your ckeditor packages. For the detailed security status of ckeditor please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ckeditor Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Ubuntu LTS security bulletin USN-5490-1 regarding PHP highlights severe XSS vulnerabilities. Immediate update advised.. CKEditor Security Update, XSS Vulnerabilities, Debian Security, Malicious Code Risks. . Severity: Critical. LinuxSecurity.com Team
Nov 09, 2021
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!