Published on September 17th, 2020 📆 | 6906 Views ⚑
0Ubuntu Security Notice USN-4498-1 ≈ Packet Storm
Ubuntu Security Notice USN-4498-1
September 15, 2020
ruby-loofah vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Loofah could be made to perform XSS attacks if a crafted SVG element is
republished
Software Description:
- ruby-loofah: manipulation and transformation of HTML/XML documents and
fragments
Details:
It was discovered that Loofah does not properly sanitize JavaScript in
sanitized output. An attacker could possibly use this issue to perform
XSS attacks. (CVE-2019-15587)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
ruby-loofah 2.0.3-2+deb9u3build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4498-1
CVE-2019-15587
Package Information:
https://launchpad.net/ubuntu/+source/ruby-loofah/2.0.3-2+deb9u3build0.16.04.1
Gloss