Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Debian 10 Buster: DLA-3230-1 Critical: jQuery-UI Code Execution

debian lts
Calendar Grey December 7, 2022
Dist Debian Esm H88
Enhance your Debian system's security by upgrading the jqeryui package in response to vulnerabilities in Advisory DLA-3230-1 to mitigate risks effectively
jQuery-UI, the official jQuery user interface library, is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery were reported to have th...
Topics%20covered

Topics Covered

security advisory critical code execution debian cross-site scripting user interface jQuery-UI

Summary

CVE-2021-41182

jQuery-UI was accepting the value of the `altField` option of the
Datepicker widget from untrusted sources may execute untrusted code.
This has been fixed and now any string value passed to the `altField`
option is now treated as a CSS selector.

CVE-2021-41183

jQuery-UI was accepting the value of various `*Text` options of the
Datepicker widget from untrusted sources may execute untrusted code.
This has been fixed and now the values passed to various `*Text`
options are now always treated as pure text, not HTML.

CVE-2021-41184

jQuery-UI was accepting the value of the `of` option of the
`.position()` util from untrusted sources may execute untrusted code.
This has been fixed and now any string value passed to the `of`
option is now treated as a CSS selector.

CVE-2022-31160

jQuery-UI was potentially vulnerable to cross-site scripting.
Initializing a checkboxradio widget on an input enclosed within a

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: jqueryui
Version: 1.12.1+dfsg-5+deb10u1
CVE ID: CVE-2021-41182 CVE-2021-41183 CVE-2021-41184
Debian Bug: 1015982

Topics%20covered

Topics Covered

security advisory critical code execution debian cross-site scripting user interface jQuery-UI

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here