Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-41183 →
DEBIAN-CVE-2021-41183
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker wid...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text options are now always treated as pure text, not HTML. A workaround is to not accept the value of the *Text options from untrusted sources.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
Debian:13
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
Debian:14
jqueryui
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org