USN-7958-1: AngularJS vulnerabilities
It was discovered that AngularJS did not properly sanitize certain xlink:href attributes. A remote attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-14863) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2022-25844) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. (CVE-2023-26116, CVE-2023-26117) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2023-26118, CVE-2024-21490) It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote attacker could possibly use this issue to perform spoofing and obtain sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2024-8372, CVE-2024-8373, CVE-2025-2336) It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote attacker could possibly use this issue to perform spoofing and obtain sensitive information. (CVE-2025-0716)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libjs-angularjsto a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.25.04.1 - Upgrade
Upgrade
ubuntu/libjs-angularjsto a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/libjs-angularjsto a version that resolves this vulnerability.Fixed in 1.8.2-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/libjs-angularjsto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Are all of the listed issues relevant to every Ubuntu release?
No. The xlink:href cross-site scripting issue (CVE-2019-14863) affects only Ubuntu 16.04 LTS. The regular-expression issue CVE-2022-25844 affects Ubuntu 20.04 LTS through Ubuntu 25.04, while CVE-2023-26118 and CVE-2024-21490 affect Ubuntu 18.04 LTS through Ubuntu 25.04.
What impact should be prioritized for systems using affected AngularJS packages?
The xlink:href flaw can allow a remote attacker to perform cross-site scripting on affected Ubuntu 16.04 LTS systems. The regular-expression flaws can cause AngularJS to consume resources, resulting in regular-expression denial of service.