Bug 1542676 - kdebase-workspace: improper sanitization of HTML tags in KDE Notifications UI
Summary: kdebase-workspace: improper sanitization of HTML tags in KDE Notifications UI
Keywords:
Status: CLOSED DUPLICATE of bug 1543454
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1542678
Blocks: 1542683
TreeView+ depends on / blocked
 
Reported: 2018-02-06 19:27 UTC by Laura Pardo
Modified: 2019-09-29 14:32 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-08 20:41:54 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-02-06 19:27:49 UTC 
A flaw was found in the KDE notification UI. HTML IMG tags are not properly sanitized, allowing to use a remote URL in an image tag. Remote attackers could exploit this for arbitrary code execution. 

References:
https://phabricator.kde.org/D10188
Comment 1 Laura Pardo 2018-02-06 19:28:32 UTC 
Created plasma-workspace tracking bugs for this issue:

Affects: fedora-all [bug 1542678]
Comment 2 Rex Dieter 2018-02-06 19:32:44 UTC 
I dispute "Remote attackers could exploit this...", remote attackers do not have the ability to send notifications in general
Comment 3 Tomas Hoger 2018-03-08 20:41:54 UTC 

*** This bug has been marked as a duplicate of bug 1543454 ***
Note You need to log in before you can comment on or make changes to this bug.