Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

Mageia: 2019-0313 moderate: libxslt security update for stack exposure

mageia
Calendar Grey November 2, 2019
Dist Mageia Esm H88
The latest libxslt update for Mageia resolves various security vulnerabilities, specifically targeting potential stack memory leakage concerns within the libxslt library.
Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNum...

Summary

Updated libxslt package fixes security vulnerabilities:
* In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117).
* In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118).
* In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197).

References

- https://bugs.mageia.org/show_bug.cgi?id=25643

- https://ubuntu.com/security/notices/USN-4164-1

- https://www.cve.org/CVERecord?id=CVE-2019-13117

- https://www.cve.org/CVERecord?id=CVE-2019-13118

- https://www.cve.org/CVERecord?id=CVE-2019-18197

Resolution

SRPMS

- 7/core/libxslt-1.1.33-2.1.mga7

Publication date: 02 Nov 2019
URL: https://advisories.mageia.org/MGASA-2019-0313.html
Type: security
CVE: CVE-2019-13117, CVE-2019-13118, CVE-2019-18197

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here