PT-2019-4769 · Libxslt+8 · Libxslt+8
Published
2019-10-18
·
Updated
2025-09-29
·
CVE-2019-18197
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libxslt version 1.1.33
Nokogiri versions prior to 1.10.5
Description
The issue is related to the xsltCopyText function in the transform.c file of the libxslt library. It involves the use of memory after it has been freed, which can lead to a bounds check failure, allowing memory outside a buffer to be written to, or the disclosure of uninitialized data. This could potentially enable a remote attacker to execute arbitrary code.
Recommendations
For libxslt version 1.1.33, update to version 1.1.34 or later, which contains a patch for this issue.
For Nokogiri versions prior to 1.10.5, upgrade to version 1.10.5 or later, as it upgrades the dependency to libxslt 1.1.34, which resolves the issue.
Exploit
Fix
Use After Free
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Google Chrome
Java Platform
Nokogiri
Red Hat
Suse
Ubuntu
Libxslt