CVE-2011-4969: jQuery 1.6.2 XSS

Debian Bug report logs - #699482
CVE-2011-4969: jQuery 1.6.2 XSS

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2011-4969: jQuery 1.6.2 XSS

Date: Thu, 31 Jan 2013 22:50:44 +0100

Package: jquery
Severity: important
Tags: security squeeze
Justification: user security hole

Hi there,
   It's 2011 calling :)
   The CVE-2011-4969 for this issue:    
http://blog.jquery.com/2011/09/01/jquery-1-6-3-released/
   I'm not sure if squeeze (1.4.2-2) is affected. Any way to check it?
  
Cheers,
luciano

Message #10 received at 699482@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Luciano Bello <luciano@debian.org>, 699482@bugs.debian.org

Subject: Re: Bug#699482: CVE-2011-4969: jQuery 1.6.2 XSS

Date: Sat, 9 Feb 2013 16:26:46 +0100

[Message part 1 (text/plain, inline)]

Control: forwarded 699482 http://bugs.jquery.com/ticket/9521

Hi Luciano

On Thu, Jan 31, 2013 at 10:50:44PM +0100, Luciano Bello wrote:
> Package: jquery
> Severity: important
> Tags: security squeeze
> Justification: user security hole
> 
> Hi there,
>    It's 2011 calling :)
>    The CVE-2011-4969 for this issue:    
> http://blog.jquery.com/2011/09/01/jquery-1-6-3-released/
>    I'm not sure if squeeze (1.4.2-2) is affected. Any way to check it?

It looks a bit 'complicated' situation[0], and upstream applied the
following commit[1]. Attached is also the debdiff, but I'm not
confortable to it right now as it's untested.
 
 [0]: http://bugs.jquery.com/ticket/9521
 [1]: https://github.com/jquery/jquery/commit/749dbad981f040bd65cbb50c10e9aa6e44bd26ff

Regards,
Salvatore

[jquery_1.4.2-2+squeeze1.debdiff (text/plain, attachment)]

Message #19 received at 699482-done@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: 699482-done@bugs.debian.org

Subject: CVE-2011-4969 was fixed in Debian in 2011

Date: Fri, 27 Jan 2017 22:05:43 +0100

[Message part 1 (text/plain, inline)]

Version: 1.6.4-1

Bug maintenance.

CVE-2011-4969 was fixed upstream in 1.6.3 which was accepted in Debian
via 1.6.4-1 on 2011-09-27. All current supported Debian versions are fixed.

Paul

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.