Vulnerability CVE-2019-13117: Information
Description
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Severity: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
libxslt | sisyphus | 1.1.33-alt2 | 1.1.39-alt1 | ALT-PU-2019-2688-1 | 237506 | Fixed |
libxslt | p10 | 1.1.33-alt2 | 1.1.34-alt3 | ALT-PU-2019-2688-1 | 237506 | Fixed |
libxslt | p9 | 1.1.34-alt1.p9.1 | 1.1.34-alt1.p9.1 | ALT-PU-2020-3348-1 | 261811 | Fixed |
libxslt | c10f1 | 1.1.33-alt2 | 1.1.37-alt1 | ALT-PU-2019-2688-1 | 237506 | Fixed |
libxslt | c9f2 | 1.1.34-alt1.p9.1 | 1.1.34-alt3 | ALT-PU-2020-3302-1 | 261812 | Fixed |
libxslt | p11 | 1.1.33-alt2 | 1.1.39-alt1 | ALT-PU-2019-2688-1 | 237506 | Fixed |