Summary
It was discovered that jQuery UI did not properly validate the values from
untrusted sources. An attacker could use this vulnerability to cause a crash or
possibly execute arbitrary code. This issue affected only Ubuntu 18.04 ESM and
Ubuntu 20.4 ESM. (CVE-2021-41184)
It was discovered that jQuery UI checkboxradio widget did not properly decode
certain values from HTML entities. An attacker could possibly use this issue to
generate a cross-site scripting(XSS) attack, resulting in a crash or possibly
execute arbitrary code. (CVE-2022-31160)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | jqueryui | 1.13.1+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Medium 6.5
XSS in the `of` option of the `.position()` util
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value pass…
-
Medium 6.1CVE-2022-31160 Public exploit
jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a labe…