[Bug 1166064] New: CVE-2012-6662 jquery-ui: XSS vulnerability in default content in Tooltip widget

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1166064

            Bug ID: 1166064
           Summary: CVE-2012-6662 jquery-ui: XSS vulnerability in default
                    content in Tooltip widget
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: vkaigoro(a)redhat.com
                CC: abaron(a)redhat.com, abokovoy(a)redhat.com,
                    andrew(a)topdog.za.net, andrewniemants(a)gmail.com,
                    aortega(a)redhat.com, apatters(a)redhat.com,
                    apevec(a)redhat.com, athmanem(a)gmail.com,
                    ayoung(a)redhat.com, bazanluis20(a)gmail.com,
                    bkabrda(a)redhat.com, bkearney(a)redhat.com,
                    bleanhar(a)redhat.com, brett.lentz(a)gmail.com,
                    bruno(a)wolff.to, casper(a)casperlefantom.net,
                    cbillett(a)redhat.com, ccoleman(a)redhat.com,
                    chat-to-me(a)raveit.de, chkr(a)plauener.de,
                    chrisw(a)redhat.com, comzeradd(a)fedoraproject.org,
                    cpelland(a)redhat.com, croberts(a)redhat.com,
                    dajohnso(a)redhat.com, dallan(a)redhat.com, dan(a)danny.cz,
                    david.r(a)ultracar.co.uk, dclarizi(a)redhat.com,
                    devrim(a)gunduz.org, dmcphers(a)redhat.com,
                    dridi.boukelmoune(a)gmail.com, echevemaster(a)gmail.com,
                    emmanuel(a)seyman.fr, erlang(a)lists.fedoraproject.org,
                    extras-orphan(a)fedoraproject.org, fabio(a)locati.cc,
                    fdc(a)fcami.net, fedora(a)famillecollet.com,
                    frankly3d(a)gmail.com, gbailey(a)lxpro.com,
                    gkotton(a)redhat.com, gmccullo(a)redhat.com,
                    herrold(a)owlriver.com, hhorak(a)redhat.com,
                    hobbes1069(a)gmail.com, home(a)trarbentley.net,
                    i(a)cicku.me, i(a)stingr.net, ian(a)ianweller.org,
                    iarnell(a)gmail.com, ipa-maint(a)redhat.com,
                    ivaxer(a)gmail.com, jamielinux(a)fedoraproject.org,
                    jaswinder(a)kernel.org, jdetiber(a)redhat.com,
                    jdornak(a)redhat.com, jhardy(a)redhat.com,
                    jialiu(a)redhat.com, jimi(a)sngx.net, jkeck(a)redhat.com,
                    jmlich(a)redhat.com, jochen(a)herr-schmitt.de,
                    joelsmith(a)redhat.com, jokajak(a)fedoraproject.org,
                    jokerman(a)redhat.com, jonathansteffan(a)gmail.com,
                    jorton(a)redhat.com, jprause(a)redhat.com,
                    jrafanie(a)redhat.com, jsmith.fedora(a)gmail.com,
                    jstribny(a)redhat.com, jvlcek(a)redhat.com,
                    karlthered(a)gmail.com, katello-bugs(a)redhat.com,
                    kevin(a)scrye.com, kseifried(a)redhat.com,
                    ktdreyer(a)ktdreyer.com, kwizart(a)gmail.com,
                    leigh123linux(a)googlemail.com, lemenkov(a)gmail.com,
                    lhh(a)redhat.com, limburgher(a)gmail.com,
                    lmacken(a)redhat.com, lmeyer(a)redhat.com,
                    loganjerry(a)gmail.com, lpeer(a)redhat.com, luto(a)mit.edu,
                    markmc(a)redhat.com, matt(a)cs.wisc.edu,
                    mbarnes(a)redhat.com, mburns(a)redhat.com,
                    mcepl(a)redhat.com, mclasen(a)redhat.com,
                    metherid(a)gmail.com, mhroncok(a)redhat.com,
                    michel(a)michel-slm.name, mike(a)cchtml.com,
                    miketwebster(a)gmail.com, mkosek(a)redhat.com,
                    mmaslano(a)redhat.com, mmccomas(a)redhat.com,
                    mmccune(a)redhat.com, mmcgrath(a)redhat.com,
                    mrunge(a)redhat.com, nelsonab(a)red-tux.net,
                    nonamedotc(a)gmail.com, nushio(a)fedoraproject.org,
                    obarenbo(a)redhat.com, oliver(a)linux-kernel.at,
                    orion(a)cora.nwra.com,
                    paulo.cesar.pereira.de.andrade(a)gmail.com,
                    pavel(a)zhukoff.net, perl-devel(a)lists.fedoraproject.org,
                    peter.borsa(a)gmail.com, phalliday(a)excelsiorsystems.net,
                    pmyers(a)redhat.com, praiskup(a)redhat.com,
                    promac(a)gmail.com, puiterwijk(a)redhat.com,
                    pviktori(a)redhat.com, pvoborni(a)redhat.com,
                    python-maint(a)redhat.com, rbean(a)redhat.com,
                    rbryant(a)redhat.com, rcritten(a)redhat.com,
                    relrod(a)redhat.com, rhos-maint(a)redhat.com,
                    rnovacek(a)redhat.com, robinlee.sysu(a)gmail.com,
                    satya.komaragiri(a)gmail.com, sclewis(a)redhat.com,
                    scott(a)foolishpride.org, sdodson(a)sdodson.com,
                    shawn.iwinski(a)gmail.com, smparrish(a)gmail.com,
                    ssorce(a)redhat.com, stickster(a)gmail.com, sven(a)lank.es,
                    tadej.janez(a)tadej.hicsalta.si,
                    tchollingsworth(a)gmail.com, thomas.moschny(a)gmx.de,
                    thozza(a)redhat.com, tim4dev(a)gmail.com, tjay(a)redhat.com,
                    tmckay(a)redhat.com, tomckay(a)redhat.com,
                    vanmeeuwen+fedora(a)kolabsys.com, volker27(a)gmx.at,
                    vondruch(a)redhat.com, vonsch(a)gmail.com,
                    wojdyr(a)gmail.com, wtogami(a)gmail.com,
                    xlecauch(a)redhat.com, yeylon(a)redhat.com,
                    yohangraterol92(a)gmail.com, zbyszek(a)in.waw.pl



jQuery UI 1.10.0 release fixes XSS issue [1] in jQuery Tooltip widget.
> From [1]: 
...
WIDGETS
Tooltip
Fixed: XSS vulnerability in default content. (#8861, f285440)
...

The issue was initially reported in [2], and then actually fixed in [3] by
commit [4].

[1]: http://jqueryui.com/changelog/1.10.0/
[2]: http://bugs.jqueryui.com/ticket/8859
[3]: http://bugs.jqueryui.com/ticket/8861
[4]:
https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf867676190...

--
Note: whiteboard lists quite some packages, which are known to have jQuery
embedded.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=nLGeAqRwc8&a=cc_unsubscribe