| Package | dojo |
|---|---|
| Version | 1.10.2+dfsg-1+deb8u4 |
| Related CVEs | CVE-2018-6561 CVE-2020-4051 CVE-2021-23450 |
Multiple vulnerabilities were found in src:dojo, as follows:
CVE-2018-6561
`dijit.Editor` in Dojo allows XSS via the onload attribute
of an SVG element.
CVE-2020-4051
In Dijit, there is a cross-site scripting vulnerability in
the Editor's LinkDialog plugin.
CVE-2021-23450
It was found that Dojo is vulnerable to Prototype Pollution
via the setObject function.
For Debian 8 jessie, these problems have been fixed in version 1.10.2+dfsg-1+deb8u4.
We recommend that you upgrade your dojo packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.