Ubuntu Security Notice 2217-1 - It was discovered that the lxml.html.clean module incorrectly stripped control characters. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks.
7117f75f37f74cb8144e237ee206d15a04b0be006cc53d7a29c7c0989a82f056
============================================================================
Ubuntu Security Notice USN-2217-1
May 21, 2014
lxml vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
lxml could allow cross-site scripting (XSS) attacks.
Software Description:
- lxml: pythonic binding for the libxml2 and libxslt libraries
Details:
It was discovered that the lxml.html.clean module incorrectly stripped
control characters. An attacked could potentially exploit this to conduct
cross-site scripting (XSS) attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-lxml 3.3.3-1ubuntu0.1
python3-lxml 3.3.3-1ubuntu0.1
Ubuntu 13.10:
python-lxml 3.2.0-1ubuntu0.1
python3-lxml 3.2.0-1ubuntu0.1
Ubuntu 12.04 LTS:
python-lxml 2.3.2-1ubuntu0.2
python3-lxml 2.3.2-1ubuntu0.2
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2217-1
CVE-2014-3146
Package Information:
https://launchpad.net/ubuntu/+source/lxml/3.3.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/3.2.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/2.3.2-1ubuntu0.2