Ubuntu alert USN-8242-1 (civicrm)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8242-1] CiviCRM vulnerability
Date:
             
 
Thu, 07 May 2026 20:43:48 +0000
Message-ID:
             
 
<E1wL5ZU-0007Wr-HV@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8242-1
May 07, 2026

civicrm vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

CiviCRM could be made to run malicious JavaScript in the user's browser
if it received specially crafted input.

Software Description:
- civicrm: Constituent relationship management solution

Details:

Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not
properly escape JavaScript code. An attacker could possibly use this issue
to conduct a cross-site scripting attack.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  civicrm-common                  5.33.2+dfsg1-1ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  civicrm-common                  5.21.2+dfsg-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  civicrm-common                  4.7.30+dfsg-1ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  civicrm-common                  4.7.1+dfsg-2ubuntu1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8242-1
  CVE-2023-28447


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmn8xykACgkQcpJm3tlz
hgEVfhAAzkaz9FsFUxyc198fIBgaNpbwAeRL0EDuL/3DYOhtSsi2WD83k7qK5nKZ
LzzslHKlYCQngR9AkHn9oWZDOCQAP3cqcGbFl+AtBO2POtBJMwD1WhlQTHS+r6I6
uMVpkoLKe6dtTe7cMsr33uoRSG4FNJEewZJRy88WhsJgbdw3yrpROXw2aUCcjwbX
Hm2kNOxCwab69wtBS1/SkFw+dr/9xcst9ic6C7JGYNmhqfNUMgCDqlul+i8CaIeX
NZnezBiJaBvFPWQwf9FPkb/ApH0IReBgBHS2LZYn7E74s4BFYwu88jfOXR3QLKZh
D/YKnYZ4FQV149ate7l4EQZqdnwOMLkYKVHTuhrVX+cuxvzfE+DNKeKL/cBLv7J2
inVy4s3kyza1wsCLY+tp+ncRU7aJjwosLni5GC4hDJft1aR8mMfM1Yi0grIirp7K
b5Hf4nrsaEVxfvZLKdXBExaxsrS+3x6qhRaWXzUULlQkGavgTv2CwBVntDEE57Td
XAYcztmEfdV9QK2TLrqFWeNk6hEHvKMxkd/UfBKkJkqzJfFhbGSZhvA/hxHHBeMG
aDtP5sKeG8dtI3RDv9IHyqcQ+I8xMC926yue/zLpycrg5UuIeespi8yZuuY2+FCq
GkuuUTysAEAwT2l4+61bMOC7P6kHdo2N4zqvTfyTK0drLoist48=
=DySx
-----END PGP SIGNATURE-----