CVE-2022-25869

NameCVE-2022-25869
DescriptionAll versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1036694

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
angular.js (PTS)bullseye1.8.2-2vulnerable
sid, trixie, bookworm1.8.3-1vulnerable
civicrm (PTS)bullseye5.33.2+dfsg1-1vulnerable
sid5.68.1+dfsg1-1vulnerable
openshot-qt (PTS)bullseye2.5.1+dfsg1-1vulnerable
bookworm2.6.1+dfsg1-3vulnerable
sid, trixie3.1.1+dfsg1-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
angular.jssource(unstable)(unfixed)1036694
civicrmsource(unstable)(unfixed)
openshot-qtsource(unstable)(unfixed)

Notes

[trixie] - angular.js <postponed> (Minor issue, revisit when fixed upstream)
[bookworm] - angular.js <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <no-dsa> (Minor issue)
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781

Search for package or bug name: Reporting problems