CVE-2016-7103: debian debian_linux

Modified

AliasesSUSE-SU-2017:2351-1RHSA-2016:2932RHSA-2016:2933+7 more

Published 15-03-2017Last modified 06-08-2024

Vulnerability summary

CVE-2016-7103 is a medium (CVSS 6.1) vulnerability in debian debian_linux. EPSS estimates a 29.19% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

29.19%

0%100%

High · +6.61 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

DLA-2889-1 USN-6419-1

Timeline

15-03-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

CVSS metrics

11 scores · 9 sources · 3 versions

v3.16.1v3.06.1v2.04.3

EPSS trend

Probability

29.19%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

Increase +6.61 pp

From 22.58% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Api.Jqueryui.Com
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle7 products

application_express< 19.1
business_intelligence12.2.1.3.0 | 12.2.1.4.0
hospitality_cruise_fleet_management9.0.11
oss_support_tools< 2.12.42 | 2.12.42
primavera_unifier≥ 16.0, ≤ 16.2 | ≥ 17.0, ≤ 17.12.4 | ≥ 18.0, ≤ 18.8.4

Show all 7

Debian2 products

jqueryui< 1.12.1+dfsg-1
debian_linuxEOL9.0

Redhat2 products

openstack7.0 | 8 | 9
python-XStatic-jquery-ui< 0:1.12.0.1-1.el7ost

Alpine1 product

drupal7< 7.86-r0

Fedoraproject1 product

fedoraEOL30 | 35 | 36

Jqueryui1 product

jquery_ui≥ 1.10.0, ≤ 1.11.4

Juniper1 product

junos21.2

Netapp1 product

snapcenterna

Npm1 product

jquery-ui< 1.12.0

NuGet1 product

jQuery.UI.Combined< 1.12.0

Opensuse1 product

python-XStatic-jquery-ui&distro=openSUSE Tumbleweed< 1.13.0.1-1.15 | < 1.13.0.1-2.4

Org.webjars.npm1 product

jquery-ui< 1.12.0

RubyGems1 product

jquery-ui-rails< 6.0.0

Suse1 product

python-XStatic-jquery-ui&distro=SUSE OpenStack Cloud 7< 1.11.0.1-2.3.1

Ubuntu1 product

jqueryui< 1.10.1+dfsg-1ubuntu0.14.04.1~esm1 | < 1.10.1+dfsg-1ubuntu0.16.04.1~esm1

15 vendors · 23 products

References

65 links

rhn.redhat.com/errata/RHSA-2017-0161.htmlVendor AdvisoryThird Party AdvisoryVDB EntryWEB
rhn.redhat.com/errata/RHSA-2016-2933.htmlVendor AdvisoryThird Party AdvisoryWEB
rhn.redhat.com/errata/RHSA-2016-2932.htmlVendor AdvisoryThird Party AdvisoryWEB
www.securityfocus.com/bid/104823VDB EntryBroken LinkThird Party Advisory
lists.apache.org/thread.html/…Mailing ListThird Party AdvisoryWEB
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing ListThird Party Advisory
lists.apache.org/thread.html/…Mailing ListThird Party AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListThird Party AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListThird Party AdvisoryWEB
lists.apache.org/thread.html/…Mailing ListThird Party AdvisoryWEB

Show all 65 references

www.oracle.com/security-alerts/cpuapr2020.htmlThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatchThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlPatchThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlPatchThird Party AdvisoryWEB
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlThird Party AdvisoryWEB
github.com/jquery/jquery-ui/commit/9644e7bae9116edaf8d37c5b38cb32b892f10ff6PatchThird Party AdvisoryWEB
github.com/jquery/api.jqueryui.com/issues/281ExploitIssue TrackingPatchThird Party AdvisoryREPORTWEB
nodesecurity.io/advisories/127Third Party AdvisoryARTICLEREPORT
www.tenable.com/security/tns-2016-19Third Party Advisory
jqueryui.com/changelog/1.12.0/Release NotesVendor Advisory
security.netapp.com/advisory/ntap-20190416-0007/Third Party Advisory
www.oracle.com//security-alerts/cpujul2021.htmlThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2022.htmlThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2022/01/msg00014.htmlMailing ListThird Party AdvisoryWEB
www.drupal.org/sa-core-2022-002Third Party AdvisoryWEB
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryMailing ListThird Party Advisory
www.suse.com/support/update/announcement/2017/suse-su-20172351-1/Advisory
bugzilla.suse.com/996004REPORT
www.suse.com/security/cve/CVE-2016-7103WEB
access.redhat.com/errata/RHSA-2016:2932Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1360286REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2932.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-7103REPORT
www.cve.org/CVERecord?id=CVE-2016-7103AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-7103Advisory
access.redhat.com/errata/RHSA-2016:2933Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2933.jsonAdvisory
access.redhat.com/errata/RHSA-2017:0161Advisory
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0161.jsonAdvisory
ubuntu.com/security/CVE-2016-7103REPORT
github.com/jquery/jquery-ui/pull/1622REPORTWEB
github.com/jquery/jquery-ui/pull/1632REPORT
ubuntu.com/security/notices/USN-6419-1Advisory
security-tracker.debian.org/tracker/CVE-2016-7103Advisory
github.com/jquery-ui-rails/jquery-ui-rails/commit/d504a40538fe5f7998439ad2f8fc5c4a1f843f1cWEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
lists.fedoraproject.org/archives/…WEB
security.netapp.com/advisory/ntap-20190416-0007WEB
web.archive.org/web/20200227030100/http://www.securityfocus.com/bid/104823WEB
lists.fedoraproject.org/archives/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
jqueryui.com/changelog/1.12.0WEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-ui-rails/CVE-2016-7103.ymlWEB
github.com/jquery/jquery-uiPACKAGE
security.alpinelinux.org/vuln/CVE-2016-7103Advisory