Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

Mageia: 2019-0313 moderate: libxslt security update for stack exposure

mageia
Calendar Grey November 2, 2019
Scroller Mageia
MGASA-2019-0313 - Updated libxslt packages fix security vulnerabilities Publication date: 02 Nov 201
Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNum...

Summary

Updated libxslt package fixes security vulnerabilities:
* In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117).
* In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118).
* In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197).

References

- https://bugs.mageia.org/show_bug.cgi?id=25643

- https://ubuntu.com/security/notices/USN-4164-1

- https://www.cve.org/CVERecord?id=CVE-2019-13117

- https://www.cve.org/CVERecord?id=CVE-2019-13118

- https://www.cve.org/CVERecord?id=CVE-2019-18197

Resolution

SRPMS

- 7/core/libxslt-1.1.33-2.1.mga7

Publication date: 02 Nov 2019
URL: https://advisories.mageia.org/MGASA-2019-0313.html
Type: security
CVE: CVE-2019-13117, CVE-2019-13118, CVE-2019-18197

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.