BD is voluntarily sharing this notification with Information Sharing and Analysis Organizations (ISAOs).

BD communicates with our customers about cybersecurity vulnerabilities to enable healthcare providers to manage potential risks through awareness and guidance.

BD is aware of and currently monitoring publicly disclosed vulnerabilities in jQuery v1.7.1 and jQuery-ui v1.10.4 libraries. These third-party vulnerabilities are not specific to BD or our products. BD is providing this update to let customers know which BD products could be affected by these third-party vulnerabilities.

BD has not received any reports of these vulnerability being exploited on BD products.

BD is currently planning to update the in-scope BD product that utilizes these third-party components. BD does not have a confirmed schedule at this time. Please refer to the Bulletins and Patches page for all approved product security patching notifications. Please check back periodically for updates.

Additionally, BD recommends the following compensating controls for customers using BD products that utilize the affected software:

• Ensure physical access controls are in place and only authorized end-users have access to the in-scope BD products.  
• Maintain proper network segmentation and protection: Place clients and servers which host the affected products behind a correctly configured firewall and have proper network segmentation in place.
• Ensure that the hosting clients and servers are up-to-date and have proper patch management controls in place where applicable.
• Have proper user rights management controls in place.
• Avoid using dedicated devices (such as these) for general-purpose tasks including accessing email or Internet browsing.