CVE-2012-6662

Name	CVE-2012-6662
Description	Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jqueryui (PTS)	stretch	1.12.1+dfsg-4	fixed
	buster	1.12.1+dfsg-5	fixed
	bullseye	1.12.1+dfsg-8	fixed
	bookworm, sid	1.13.0+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
jqueryui	source	squeeze	(not affected)
jqueryui	source	wheezy	(not affected)
jqueryui	source	(unstable)	1.10.1+dfsg-1

Notes

[wheezy] - jqueryui <not-affected> (ui.tooltip not yet present)
[squeeze] - jqueryui <not-affected> (code not present)
http://bugs.jqueryui.com/ticket/8861
https://github.com/jquery/jquery-ui/commit/f2854408cce7e4b7fc6bf8676761904af9c96bde