A dojo security update has been released for Debian GNU/Linux 8 Extended LTS to address multiple vulnerabilities.

ELA-559-1 dojo security update

Package dojo
Version 1.10.2+dfsg-1+deb8u4
Related CVEs CVE-2018-6561 CVE-2020-4051 CVE-2021-23450

Multiple vulnerabilities were found in src:dojo, as follows:

CVE-2018-6561

`dijit.Editor` in Dojo allows XSS via the onload attribute
of an SVG element.
CVE-2020-4051

In Dijit, there is a cross-site scripting vulnerability in
the Editor's LinkDialog plugin.
CVE-2021-23450

It was found that Dojo is vulnerable to Prototype Pollution
via the setObject function.
For Debian 8 jessie, these problems have been fixed in version 1.10.2+dfsg-1+deb8u4.

We recommend that you upgrade your dojo packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-559-1 dojo security update