This bug was fixed in the package webkitkde - 1.3.4-1ubuntu0.1
---------------
webkitkde (1.3.4-1ubuntu0.1) utopic-security; urgency=medium
* SECURITY UPDATE: Insufficient Input Validation By IO Slaves and
Webkit Part
- Add upstream_cve-2014-8600.diff to escape protocol twice: once
for i18n, and once for HTML
- https://www.kde.org/info/security/advisory-20141113-1.txt
- CVE-2014-8600
- LP: #1393479
-- Jonathan Riddell <jridd...@ubuntu.com> Mon, 17 Nov 2014 17:44:29 +0100
** Changed in: webkitkde (Ubuntu Trusty)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Studio Bugs, which is subscribed to kde-runtime in Ubuntu.
Matching subscriptions: Ubuntu Studio Bugs
https://bugs.launchpad.net/bugs/1393479
Title:
security: Insufficient Input Validation By IO Slaves and Webkit Part
Status in “kde-runtime” package in Ubuntu:
Fix Released
Status in “kio-extras” package in Ubuntu:
Fix Released
Status in “webkitkde” package in Ubuntu:
Fix Released
Status in “kde-runtime” source package in Precise:
Fix Released
Status in “kio-extras” source package in Precise:
Invalid
Status in “webkitkde” source package in Precise:
Fix Released
Status in “kde-runtime” source package in Trusty:
Fix Released
Status in “kio-extras” source package in Trusty:
Invalid
Status in “webkitkde” source package in Trusty:
Fix Released
Status in “kde-runtime” source package in Utopic:
Fix Released
Status in “kio-extras” source package in Utopic:
Invalid
Status in “webkitkde” source package in Utopic:
Fix Released
Status in “kde-runtime” source package in Vivid:
Fix Released
Status in “kio-extras” source package in Vivid:
Fix Released
Status in “webkitkde” source package in Vivid:
Fix Released
Bug description:
https://www.kde.org/info/security/advisory-20141113-1.txt
verview
========
kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly
allowing to
some javascript being executed on the context of the referenced hostname. For
example going to
bookmarks://hhdhdhhdhdhdh.google.com/'><script>alert('bookmarks'+document.domain);</script>
in Konqueror makes a Javascript alert popup.
Impact
======
Whilst in most cases, the JavaScript will be executed in an untrusted
context, with the bookmarks IO slave,
it will be executed in the context of the referenced hostname. In the example
above, this is hhdhdhhdhdhdh.google.com.
It should however be noted that KDE mitigates this risk by attempting to
ensure that such URLs cannot be embedded directly
into Internet hosted content.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kde-runtime/+bug/1393479/+subscriptions
--
Mailing list: https://launchpad.net/~ubuntustudio-bugs
Post to : ubuntustudio-bugs@lists.launchpad.net
Unsubscribe : https://launchpad.net/~ubuntustudio-bugs
More help : https://help.launchpad.net/ListHelp
