Ubuntu Security Notice 6419-1 - Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue to perform a cross-site scripting attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
05388b73a403c354a99e6e89119bc4f5977a6dc6cffe23761717eab763f7e15d
==========================================================================
Ubuntu Security Notice USN-6419-1
October 05, 2023
jqueryui vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in jQuery UI.
Software Description:
- jqueryui: JavaScript UI library for dynamic web applications
Details:
Hong Phat Ly discovered that jQuery UI did not properly manage parameters
from untrusted sources, which could lead to arbitrary web script or HTML
code injection. A remote attacker could possibly use this issue to perform
a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)
Esben Sparre Andreasen discovered that jQuery UI did not properly handle
values from untrusted sources in the Datepicker widget. A remote attacker
could possibly use this issue to perform a cross-site scripting (XSS)
attack and execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-41182, CVE-2021-41183)
It was discovered that jQuery UI did not properly validate values from
untrusted sources. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-41184)
It was discovered that the jQuery UI checkboxradio widget did not properly
decode certain values from HTML entities. An attacker could possibly use
this issue to perform a cross-site scripting (XSS) attack and cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS. (CVE-2022-31160)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1
node-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm3
node-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm3
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libjs-jquery-ui 1.10.1+dfsg-1ubuntu0.16.04.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libjs-jquery-ui 1.10.1+dfsg-1ubuntu0.14.04.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6419-1
CVE-2016-7103, CVE-2021-41182, CVE-2021-41183, CVE-2021-41184,
CVE-2022-31160
Package Information:
https://launchpad.net/ubuntu/+source/jqueryui/1.12.1+dfsg-5ubuntu0.20.04.1