ubuntustudio-bugs team mailing list archive

[Jonathan Riddell <jriddell@xxxxxxxxxx>]

Public bug reported:

https://www.kde.org/info/security/advisory-20141113-1.txt

verview
========

kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to
some javascript being executed on the context of the referenced hostname. For example going to
   bookmarks://hhdhdhhdhdhdh.google.com/'><script>alert('bookmarks'+document.domain);</script>
in Konqueror makes a Javascript alert popup.

Impact
======

Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO slave,
it will be executed in the context of the referenced hostname. In the example above, this is hhdhdhhdhdhdh.google.com.
It should however be noted that KDE mitigates this risk by attempting to ensure that such URLs cannot be embedded directly
into Internet hosted content.

** Affects: kde-runtime (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: kio-extras (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: webkitkde (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: kde-runtime (Ubuntu Precise)
     Importance: Undecided
         Status: New

** Affects: kio-extras (Ubuntu Precise)
     Importance: Undecided
         Status: New

** Affects: webkitkde (Ubuntu Precise)
     Importance: Undecided
         Status: New

** Affects: kde-runtime (Ubuntu Trusty)
     Importance: Undecided
         Status: New

** Affects: kio-extras (Ubuntu Trusty)
     Importance: Undecided
         Status: New

** Affects: webkitkde (Ubuntu Trusty)
     Importance: Undecided
         Status: New

** Affects: kde-runtime (Ubuntu Utopic)
     Importance: Undecided
         Status: New

** Affects: kio-extras (Ubuntu Utopic)
     Importance: Undecided
         Status: New

** Affects: webkitkde (Ubuntu Utopic)
     Importance: Undecided
         Status: New

** Affects: kde-runtime (Ubuntu Vivid)
     Importance: Undecided
         Status: New

** Affects: kio-extras (Ubuntu Vivid)
     Importance: Undecided
         Status: New

** Affects: webkitkde (Ubuntu Vivid)
     Importance: Undecided
         Status: New

** Also affects: kde-runtime (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: kio-extras (Ubuntu)
   Importance: Undecided
       Status: New

** Also affects: webkitkde (Ubuntu Trusty)
   Importance: Undecided
       Status: New

** Also affects: kde-runtime (Ubuntu Trusty)
   Importance: Undecided
       Status: New

** Also affects: kio-extras (Ubuntu Trusty)
   Importance: Undecided
       Status: New

** Also affects: webkitkde (Ubuntu Precise)
   Importance: Undecided
       Status: New

** Also affects: kde-runtime (Ubuntu Precise)
   Importance: Undecided
       Status: New

** Also affects: kio-extras (Ubuntu Precise)
   Importance: Undecided
       Status: New

** Also affects: webkitkde (Ubuntu Vivid)
   Importance: Undecided
       Status: New

** Also affects: kde-runtime (Ubuntu Vivid)
   Importance: Undecided
       Status: New

** Also affects: kio-extras (Ubuntu Vivid)
   Importance: Undecided
       Status: New

** Also affects: webkitkde (Ubuntu Utopic)
   Importance: Undecided
       Status: New

** Also affects: kde-runtime (Ubuntu Utopic)
   Importance: Undecided
       Status: New

** Also affects: kio-extras (Ubuntu Utopic)
   Importance: Undecided
       Status: New

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-8600

-- 
You received this bug notification because you are a member of Ubuntu
Studio Bugs, which is subscribed to kde-runtime in Ubuntu.
Matching subscriptions: Ubuntu Studio Bugs
https://bugs.launchpad.net/bugs/1393479

Title:
  security: Insufficient Input Validation By IO Slaves and Webkit Part

Status in “kde-runtime” package in Ubuntu:
  New
Status in “kio-extras” package in Ubuntu:
  New
Status in “webkitkde” package in Ubuntu:
  New
Status in “kde-runtime” source package in Precise:
  New
Status in “kio-extras” source package in Precise:
  New
Status in “webkitkde” source package in Precise:
  New
Status in “kde-runtime” source package in Trusty:
  New
Status in “kio-extras” source package in Trusty:
  New
Status in “webkitkde” source package in Trusty:
  New
Status in “kde-runtime” source package in Utopic:
  New
Status in “kio-extras” source package in Utopic:
  New
Status in “webkitkde” source package in Utopic:
  New
Status in “kde-runtime” source package in Vivid:
  New
Status in “kio-extras” source package in Vivid:
  New
Status in “webkitkde” source package in Vivid:
  New

Bug description:
  https://www.kde.org/info/security/advisory-20141113-1.txt

  verview
  ========

  kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to
  some javascript being executed on the context of the referenced hostname. For example going to
     bookmarks://hhdhdhhdhdhdh.google.com/'><script>alert('bookmarks'+document.domain);</script>
  in Konqueror makes a Javascript alert popup.

  Impact
  ======

  Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO slave,
  it will be executed in the context of the referenced hostname. In the example above, this is hhdhdhhdhdhdh.google.com.
  It should however be noted that KDE mitigates this risk by attempting to ensure that such URLs cannot be embedded directly
  into Internet hosted content.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kde-runtime/+bug/1393479/+subscriptions