USN-3841-1: lxml vulnerability

Releases

• Ubuntu 18.04 LTS
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• lxml - pythonic binding for the libxml2 and libxslt libraries

Details

It was discovered that lxml incorrectly handled certain HTML files.
An attacker could possibly use this issue to conduct cross-site scripting
(XSS) attacks.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• python-lxml - 4.2.1-1ubuntu0.1
• python3-lxml - 4.2.1-1ubuntu0.1

Ubuntu 16.04

• python-lxml - 3.5.0-1ubuntu0.1
• python3-lxml - 3.5.0-1ubuntu0.1

Ubuntu 14.04

• python-lxml - 3.3.3-1ubuntu0.2
• python3-lxml - 3.3.3-1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2018-19787

Related notices

• USN-3841-2: python-lxml, python3-lxml, lxml