USN-5225-1: lxml vulnerability
12 January 2022
lxml could be made to execute arbitrary code if it received a specially crafted XML or HTML file.
Releases
Packages
- lxml - pythonic binding for the libxml2 and libxslt libraries
Details
It was discovered that lxml incorrectly handled certain XML and HTML files.
An attacker could possibly use this issue to execute arbitrary code.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.10
Ubuntu 21.04
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
-
python-lxml
-
3.5.0-1ubuntu0.4+esm2
Available with UA Infra or UA Desktop
-
python3-lxml
-
3.5.0-1ubuntu0.4+esm2
Available with UA Infra or UA Desktop
Ubuntu 14.04
-
python-lxml
-
3.3.3-1ubuntu0.2+esm5
Available with UA Infra or UA Desktop
-
python3-lxml
-
3.3.3-1ubuntu0.2+esm5
Available with UA Infra or UA Desktop
In general, a standard system update will make all the necessary changes.