USN-6419-1: jQuery UI vulnerabilities
5 October 2023
Several security issues were fixed in jQuery UI.
Releases
Packages
- jqueryui - JavaScript UI library for dynamic web applications
Details
Hong Phat Ly discovered that jQuery UI did not properly manage parameters
from untrusted sources, which could lead to arbitrary web script or HTML
code injection. A remote attacker could possibly use this issue to perform
a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-7103)
Esben Sparre Andreasen discovered that jQuery UI did not properly handle
values from untrusted sources in the Datepicker widget. A remote attacker
could possibly use this issue to perform a cross-site scripting (XSS)
attack and execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-41182, CVE-2021-41183)
It was discovered that jQuery UI did not properly validate values from
untrusted sources. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-41184)
It was discovered that the jQuery UI checkboxradio widget did not properly
decode certain values from HTML entities. An attacker could possibly use
this issue to perform a cross-site scripting (XSS) attack and cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 20.04 LTS. (CVE-2022-31160)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
-
libjs-jquery-ui
-
1.12.1+dfsg-5ubuntu0.18.04.1~esm3
Available with Ubuntu Pro
-
node-jquery-ui
-
1.12.1+dfsg-5ubuntu0.18.04.1~esm3
Available with Ubuntu Pro
Ubuntu 16.04
-
libjs-jquery-ui
-
1.10.1+dfsg-1ubuntu0.16.04.1~esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
libjs-jquery-ui
-
1.10.1+dfsg-1ubuntu0.14.04.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.