PT-2019-4668 · Libxslt+6 · Libxslt+6
Published
2019-01-02
·
Updated
2024-06-15
·
CVE-2019-13118
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
libxslt version 1.1.33
Nokogiri versions prior to 1.10.5
Description
The issue arises from insufficient input validation in the
xsltNumberFormatDecimal function of the libxslt library. This could allow a remote attacker to gain unauthorized access to protected information. The problem is caused by a type holding grouping characters of an xsl:number instruction being too narrow, leading to an invalid character/length combination being passed to xsltNumberFormatDecimal, and resulting in a read of uninitialized stack data.Recommendations
For libxslt version 1.1.33, update to version 1.1.34 or later to address this issue.
For Nokogiri versions prior to 1.10.5, update to version 1.10.5 or later, which includes an updated version of libxslt that addresses this vulnerability.
Fix
Type Confusion
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Java Platform
Nokogiri
Suse
Ubuntu
Itunes
Libxslt