CVE-2024-43370

Publication date 16 August 2024

Last updated 24 August 2024

Ubuntu priority

Medium

Why this priority?

gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting (XSS) injection if `.po` dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.

Status

Package Ubuntu Release Status
gettext.js 24.10 oracular
Not affected
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation