usn-5340-2
Vulnerability from osv_ubuntu
USN-5340-1 fixed several vulnerabilities in CKEditor. This update provides the fixes for CVE-2018-9861, CVE-2020-9281, CVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.
Original advisory details:
Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS. (CVE-2018-9861)
Micha Bentkowski discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 21.10. (CVE-2021-32808)
Anton Subbotin discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code. (CVE-2021-32809)
Or Sahar discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)
Mika Kulmala discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-37695)
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2018-9861",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2020-9281",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-32809",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-33829",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2021-37695",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "ckeditor",
"binary_version": "4.5.7+dfsg-2ubuntu0.16.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "ckeditor",
"purl": "pkg:deb/ubuntu/ckeditor@4.5.7+dfsg-2ubuntu0.16.04.1~esm1?arch=source\u0026distro=esm-apps/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.7+dfsg-2ubuntu0.16.04.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.4.4+dfsg1-3",
"4.5.6+dfsg-1",
"4.5.7+dfsg-1",
"4.5.7+dfsg-2"
]
}
],
"aliases": [],
"details": "USN-5340-1 fixed several vulnerabilities in CKEditor.\nThis update provides the fixes for CVE-2018-9861, CVE-2020-9281,\nCVE-2021-32809, CVE-2021-33829 and CVE-2021-37695 for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\nKyaw Min Thein discovered that CKEditor incorrectly handled\ncertain inputs. An attacker could possibly use this issue\nto execute arbitrary code. This issue only affects\nUbuntu 18.04 LTS. (CVE-2018-9861)\n\nMicha Bentkowski discovered that CKEditor incorrectly handled\ncertain inputs. An attacker could possibly use this issue to\nexecute arbitrary code. This issue only affects\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-9281)\n\nAnton Subbotin discovered that CKEditor incorrectly handled\ncertain inputs. An attacker could possibly use this issue to\nexecute arbitrary code. This issue only affects\nUbuntu 21.10. (CVE-2021-32808)\n\nAnton Subbotin discovered that CKEditor incorrectly handled\ncertain inputs. An attacker could possibly use this issue to\ninject arbitrary code. (CVE-2021-32809)\n\nOr Sahar discovered that CKEditor incorrectly handled certain\ninputs. An attacker could possibly use this issue to execute\narbitrary code. This issue only affects\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33829)\n\nMika Kulmala discovered that CKEditor incorrectly handled\ncertain inputs. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2021-37695)\n",
"id": "USN-5340-2",
"modified": "2026-06-25T10:46:04Z",
"published": "2022-03-23T08:57:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-5340-2"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2018-9861"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2020-9281"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-32809"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-33829"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2021-37695"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "ckeditor vulnerabilities",
"upstream": [
"UBUNTU-CVE-2018-9861",
"UBUNTU-CVE-2020-9281",
"UBUNTU-CVE-2021-32809",
"UBUNTU-CVE-2021-33829",
"UBUNTU-CVE-2021-37695"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.