And when I say version I mean major versions!

the best info seems to be at http://bugs.jqueryui.com/ticket/6016

I quickly checked our source code, it looks like Zabbix is not vulnerable. There is just a single place in Zabbix code where we use fixed string (therefore it's not possible to inject any JS) title for jQuery dialog.

Front-end developers will have a look at the code more carefully soon.

arvids.godjuks Checked the code for latest versions of 2.0, 2.2, 2.5 and 2.5 - as alexei has written, code that uses the title of the dialog, is using the constant strings in code to set the dialog titles, so code is not affected by the CVE in question.
And we ship jQuery UI 1.10.3 as of zabbix 2.2, where this issue has been fixed upstream.

Thanks for checking so quickly!

I just realized that there's actually another CVE. Can you have a look a this one too?

https://bugzilla.redhat.com/show_bug.cgi?id=1166064

oleg.egorov In Zabbix 2.4 and 2.5 jquery version is 1.10.2 and there this issue don't exist.
But in 2.0 and 2.2 version is 1.7.2... potentially vulnerable. BUT we don't use autocomplete in comboboxes and other danger methods.

reopening as per the previous comment