libjs-jquery-ui: jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery
CVE-2022-31160 is fixed in 4 products on 1 platform, first by libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2, released July 20, 2022. It is not reported as exploited. Patch Radar priority: Routine.
jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| jqueryui · Debian 12.15 (bookworm) | 1.13.2+dfsg-1 | DEBIAN-CVE-2022-31160 | Jul 20, 2022 |
| jqueryui · Debian 13.5 (trixie) | 1.13.2+dfsg-1 | DEBIAN-CVE-2022-31160 | Jul 20, 2022 |
| jqueryui · Debian 14 | 1.13.2+dfsg-1 | DEBIAN-CVE-2022-31160 | Jul 20, 2022 |
| libjs-jquery-ui · Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | Jul 20, 2022 |
| libjs-jquery-ui · Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | libjs-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | Jul 20, 2022 |
| libjs-jquery-ui · Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | libjs-jquery-ui 1.13.1+dfsg-1ubuntu0.1~esm1 | Jul 20, 2022 |
| libjs-jquery-ui-docs · Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | libjs-jquery-ui-docs 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | Jul 20, 2022 |
| libjs-jquery-ui-docs · Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | libjs-jquery-ui-docs 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | Jul 20, 2022 |
| libjs-jquery-ui-docs · Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | libjs-jquery-ui-docs 1.13.1+dfsg-1ubuntu0.1~esm1 | Jul 20, 2022 |
| node-jquery-ui · Ubuntu 18.04.6 LTS (bionic) | 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | node-jquery-ui 1.12.1+dfsg-5ubuntu0.18.04.1~esm2 | Jul 20, 2022 |
| node-jquery-ui · Ubuntu 20.04 LTS (focal) | 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | node-jquery-ui 1.12.1+dfsg-5ubuntu0.20.04.1~esm3 | Jul 20, 2022 |
| node-jquery-ui · Ubuntu 22.04.1 LTS (jammy) | 1.13.1+dfsg-1ubuntu0.1~esm1 | node-jquery-ui 1.13.1+dfsg-1ubuntu0.1~esm1 | Jul 20, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.