Security Updates:
CVE-2020-9281 Fixed XSS vulnerability in the HTML data processor reported by MichaĆ Bentkowski of Securitum.
Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode or (i) copy the specially crafted HTML code, prepared by the attacker and (ii) paste it into CKEditor in WYSIWYG mode.
CVE-2020-9440 Fixed XSS vulnerability in the WebSpellChecker Dialog plugin reported by Pham Van Khanh from Viettel Cyber Security.
Issue summary: It was possible to execute XSS using CKEditor after persuading the victim to: (i) switch CKEditor to source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker, into the opened CKEditor source area, then (iii) switch back to WYSIWYG mode, and (iv) preview CKEditor content outside CKEditor editable area.
An upgrade is highly recommended!
New features:
aria-selected="true"
attribute.widget.getClipboardHtml()
support for dragging and dropping multiple widgets.Fixed Issues:
editor.extractSelectedHtml()
method after selecting all content.<span>
tags when reapplying the same font multiple times.API Changes:
textColor
and bgColor
commands that apply the selected color chosen by the Color Button plugin.font
and fontSize
commands that apply the selected font style chosen by the Font plugin.editor.getSelectedRanges()
alias.Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2020-a832c215bf
Please login to add feedback.
This update has been submitted for testing by siwinski.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
This update can be pushed to stable now if the maintainer wishes
This update has been submitted for stable by bodhi.
This update has been pushed to stable.