[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 1777-1] jquery security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Package        : jquery
Version        : 1.7.2+dfsg-3.2+deb8u6
CVE ID         : CVE-2019-11358

jQuery mishandles jQuery.extend(true, {}, ...) because of Object.prototype
pollution.  If an unsanitized source object contained an enumerable __proto__
property, it could extend the native Object.prototype. For additional
information, please refer to the upstream advisory at
https://www.drupal.org/sa-core-2019-006 .

For Debian 8 "Jessie", this problem has been fixed in version
1.7.2+dfsg-3.2+deb8u6.

We recommend that you upgrade your jquery packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEKpwfR8DOwu5vyB4TKpJZkldkSvoFAlzP4J8ACgkQKpJZkldk
Svpt1g/+MYT8NDzUW5U62FYWxdCAJ3LdG59tacSZ0TS1JR1erFbI4HGs/SzqgmmJ
ZV1cR2hehh2f40UypfX840NqigWNGPsTkOKMGjZL8q/aggkq4BPbPJcUnZ4+9Vrx
/PLjSG8Pyu1gYeANtbiQZ3OzOXnBJLU6R43zmlOJ6A7nYhkPnCVZ4g5+Siwcj1Tj
FeLHTZhLgQfNl+19Cvt9vJe/w2UZLEX0RwLZYC3XWNPgiXG3LF+0oleKARTp/iwz
vJ4E/wKICMWVFTsrqNfOI6lKbyeyAveFPs0AHcayoWoEbp2ZKwL9iwlKt5nk3doB
QedkRH540+jfSPX/P8ruCtrTPD0z3gM6xF6iyYPdWo4DkhVl/VwqtxB/ng1KFmML
QH6rZ+hVAcYE/lbh3RzH5cj3DSQgqNj932792Mq1f9J0kCOh0pcDtma5hiNVX97R
Zz1aRQ74+49HhVMxCgc12wTNSrSBVV1BncfnHb1eHwwJQgvdQKneuV8PMQrcuVQm
KILkKQjw9MlRX+B9DwzWUUwCMYu8MKznAe0O78QcoKiUWFk8wV7QbjM0Vw1P6elw
nxcILgEgmHKs+y2A9w0CTUcvValL9qu7RNjzbP1NOoHqYoIFMDVQT3CJySyLsIZH
vogQEdiSeAXpoHVhD7ZPVXOFL+uCO/ObCkimSuajBitPNUGmwy0=
=rRg7
-----END PGP SIGNATURE-----


Reply to: