Description
Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | db4o | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | db4o | No fix yet | — |
| Ubuntu 20.04 LTS | db4o | No fix yet | — |
| Ubuntu 18.04 LTS | db4o | No fix yet | — |
| Ubuntu 16.04 LTS | db4o | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +9 | 3.1.1.6-1.git.0.b57e8bd.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | heapster | 0.18.2-3.gitaf4752e.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | jenkins | 1.625.3-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-ansi-green +1 | 0.1.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-ansi-wrap +1 | 0.1.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-anymatch | 1.3.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-arr-diff +8 | 2.0.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-array-unique | 0.2.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-arrify +8 | 1.0.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-binary-extensions | 1.3.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-braces | 1.8.2-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-chokidar | 1.4.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-configstore | 1.4.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-create-error-class | 2.0.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-deep-extend | 0.3.2-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-duplexer | 0.1.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-duplexify | 3.4.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-end-of-stream | 1.1.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-error-ex | 1.2.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-es6-promise | 3.0.2-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-event-stream | 3.3.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-expand-range | 1.8.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-extglob | 0.3.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-fill-range | 2.2.3-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-for-in +1 | 0.1.4-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-for-own +1 | 0.1.3-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-from +1 | 0.1.3-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-glob-base | 0.3.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-got | 5.2.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-graceful-fs | 4.1.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-ini | 1.1.0-6.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-is-dotfile +1 | 1.0.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-is-number +1 | 2.1.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-is-stream +1 | 1.0.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-kind-of | 3.0.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.assign +1 | 3.2.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.basecopy +1 | 3.0.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.createassigner | 3.1.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.getnative | 3.9.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.isiterateecall | 3.0.9-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.keys +1 | 3.1.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-lodash.restparam | 3.6.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-micromatch | 2.3.5-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-mkdirp | 0.5.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-nodemon | 1.8.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-object-assign | 4.0.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-optimist | 0.4.0-5.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-osenv +1 | 0.1.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-package-json | 2.3.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-parse-glob +2 | 3.0.4-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-parse-json | 2.2.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-pause-stream | 0.0.11-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-preserve | 0.2.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-ps-tree +5 | 1.0.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-randomatic | 1.1.5-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-rc +1 | 1.1.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-read-all-stream | 3.0.1-3.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-readdirp | 2.0.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-regex-cache | 0.4.2-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-registry-url | 3.0.3-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-semver | 5.1.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-slide | 1.1.5-3.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-split | 0.3.3-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-stream-combiner | 0.2.1-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-strip-json-comments | 1.0.2-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-through | 2.3.4-4.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-timed-out | 2.0.0-3.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-touch +2 | 1.0.0-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-undefsafe | 0.0.3-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-update-notifier | 0.6.0-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-uuid +3 | 2.0.1-1.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nodejs-write-file-atomic | 1.1.2-2.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | nss_wrapper | 1.0.3-1.el7 | RHSA-2016:0070 |
| Red Hat OpenShift 3 | openshift-ansible +6 | 3.0.35-1.git.0.6a386dd.el7aos | RHSA-2016:0070 |
| Red Hat OpenShift 3 | openvswitch +3 | 2.4.0-1.el7 | RHSA-2016:0070 |
| Red Hat OpenShift 3 | origin-kibana | 0.5.0-1.el7aos | RHSA-2016:0070 |
Advisories 1
- RHSA-2016:0070 Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1.1 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://github.com/zeroclipboard/zeroclipboard/pull/335
- zeroclipboard-cve20141869-xss(91085) vdb-entry
- 56821 third-party-advisory
- 65484 vdb-entry
- RHSA-2016:0070 vendor-advisory
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01
- https://github.com/zeroclipboard/zeroclipboard/releases/tag/v1.3.2
- https://github.com/zeroclipboard/zeroclipboard/commit/2f9eb9750a433965572d047e24b0fc78fd1415ca