Ubuntu alert USN-8220-1 (htmlunit)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8220-1] HtmlUnit vulnerability
Date:
             
 
Thu, 07 May 2026 18:19:46 +0000
Message-ID:
             
 
<E1wL3K6-00082N-E2@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8220-1
May 05, 2026

htmlunit vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

HtmlUnit could be made to run programs as your login if it
opened a malicious website.

Software Description:
- htmlunit: headless web browser written in Java

Details:

It was discovered that HtmlUnit was vulnerable to remote code execution
via XSLT when browsing an attacker-controlled webpage. An attacker could possibly use
this issue to execute arbitrary code in the context of the application using HtmlUnit.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
  libhtmlunit-java                2.8-3ubuntu1+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libhtmlunit-java                2.8-1ubuntu2.1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8220-1
  CVE-2023-49093


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmn80qAACgkQcpJm3tlz
hgGxCg/+L5UUhlJH2CujQ15wIRliPPkoj+6z4CmcN9kZIFvfEcjpryesFEvW4d1Q
oXHMEqQSiG96hxNSoqB0D0UPNSMgSMHOJroCQ6mk+AJp/Z/8SzsCPaBSshOB1S+Z
/5bBA/nGJl/1IcYhX1NV9Gt9UHLjVpYrq9Mthm8XkPM1xRt57cEqOGv3mQHIP6Ri
abSnmVV4rh7IiIcAuQn5bJG7XJUmUcZ1O2fDr5Gfups82mB8ttitSZJWGPVIxYlx
yfTnYgq+GLSF42VDU+IWwnKihZOkwdTTgZRx4wbHKYBT5E6z6rIIl04cLTEExBOq
L3NR+KUeawt5zs4sQokHOou0GmqRBw3CUZfhHOhdJTL9lqOrcVMEV7WUSyyXAQF1
JEJDfbDlVvKtH8BNnxTrrt2MvOcQ2JDXUJjHZ82D8FxhVZq0qHIlQgrk6Ex8h628
S8b6ENrj/Uq312M8A/wgKXSEcJmjBTuEAiYn8hOicEkk3wNa7rZRTCULxQszONwF
Kv6gbqCSmKJ7AAMZU0al1RHvFr70wCpLVtSsyed1vruOUUP37jwyn/juolNW3ReL
QYg0D7Sca7FYYzmKofDlJGuvJogyLG9TjTafEnFIAKaXFRQWTGXl724jbZib+Sl3
b59Z+hFrIuBkkpG3DI404Lg6MLlm7nY4PQfrhyuquMpkViYgs8Y=
=bpIN
-----END PGP SIGNATURE-----