USN-4498-1: Loofah vulnerability

15 September 2020

Loofah could be made to perform XSS attacks if a crafted SVG element is republished

Releases

Packages

  • ruby-loofah - manipulation and transformation of HTML/XML documents and fragments

Details

It was discovered that Loofah does not properly sanitize JavaScript in
sanitized output. An attacker could possibly use this issue to perform
XSS attacks. (CVE-2019-15587)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

In general, a standard system update will make all the necessary changes.

References