CVE-2015-9251
Publication date 18 January 2018
Last updated 22 September 2026
Ubuntu priority
Description
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| pcs | 26.04 LTS resolute |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| jquery | 20.04 LTS focal |
Not affected
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial | Ignored | |
| 14.04 LTS trusty | Ignored end of standard support |
Notes
mdeslaur
fix is intrusive and backwards-incompatible, see bug 3011 Due to this, we will not be fixing this issue in Ubuntu stable releases. Marking as ignored.
yomonokio
pcs vendors jQuery 1.9.1 on xenial/bionic/focal (in range <3.0.0) and 3.6.0 on jammy+ (fixed); noble+ ships no jQuery at all. pcsd's own JS never issues a cross-domain $.ajax() call (no crossDomain:true, all URLs relative/same-origin), so the CVE's trigger condition is not reachable. Marking not-affected.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.1 · Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N