CVE-2016-7103
Fixed in a distro release EPSS 29%
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Products: jqueryui jquery_ui, oracle application_express, oracle business_intelligence, oracle hospitality_cruise_fleet_management, oracle oss_support_tools, oracle primavera_unifier, oracle siebel_ui_framework, oracle weblogic_server, fedoraproject fedora, netapp snapcenter, redhat openstack, juniper junos, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.webjars.npm:jquery-ui | 1.12.0 |
| NuGet | jQuery.UI.Combined | 1.12.0 |
| RubyGems | jquery-ui-rails | 6.0.0 |
| npm | jquery-ui | 1.12.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | jqueryui | 1.12.1+dfsg-1 |
| Debian 13 | jqueryui | 1.12.1+dfsg-1 |
| Debian 14 | jqueryui | 1.12.1+dfsg-1 |
| Debian 9 | drupal7 | 7.52-2+deb9u17 |
| Red Hat openstack 7 | python-XStatic-jquery-ui | 0:1.12.0.1-1.el7ost |
| Red Hat openstack 8 | python-XStatic-jquery-ui | 0:1.12.0.1-1.el7ost |
| Red Hat openstack 9 | python-XStatic-jquery-ui | 0:1.12.0.1-1.el7ost |
| SUSE OpenStack Cloud 7 | python-XStatic-jquery-ui | 1.11.0.1-2.3.1 |
| Ubuntu 20.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.20.04.1 |
| Ubuntu Pro 14.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.14.04.1~esm1 |
| Ubuntu Pro 16.04 LTS | jqueryui | 1.10.1+dfsg-1ubuntu0.16.04.1~esm1 |
| Ubuntu Pro 18.04 LTS | jqueryui | 1.12.1+dfsg-5ubuntu0.18.04.1~esm3 |
| openSUSE Tumbleweed | python-XStatic-jquery-ui | 1.13.0.1-2.4 |
| openSUSE Tumbleweed | python-XStatic-jquery-ui | 1.13.0.1-1.15 |