Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2020-15138 →

DEBIAN-CVE-2020-15138

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arb...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 node-prismjs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0+dfsg-4"}]}]

Debian:13 node-prismjs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0+dfsg-4"}]}]

Debian:14 node-prismjs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0+dfsg-4"}]}]

Références

advisory security-tracker.debian.org