Lucene search

[email protected]NVD:CVE-2019-13118

HistoryJul 01, 2019 - 2:15 a.m.

CVE-2019-13118

2019-07-0102:15:09

CWE-843

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.004

Percentile

72.7%

JSON

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

Affected configurations

Nvd

Node

xmlsoftlibxsltMatch1.1.33

Node

opensuseleapMatch15.1

Node

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

netappcloud_backupMatch-

netappclustered_data_ontapMatch-

netappe-series_performance_analyzerMatch-

netappe-series_santricity_management_plug-insMatch-vmware_vcenter

netappe-series_santricity_os_controllerRange11.0–11.50.2

netappe-series_santricity_storage_managerMatch-

netappe-series_santricity_web_servicesMatch-web_services_proxy

netapponcommand_insightMatch-

netapponcommand_workflow_automationMatch-

netappontap_select_deploy_administration_utilityMatch-

netappplug-in_for_symantec_netbackupMatch-

netappsantricity_unified_managerMatch-

netappsteelstore_cloud_integrated_storageMatch-

Node

oraclejdkMatch1.8.0update231

Node

fedoraprojectfedoraMatch31

Node

canonicalubuntu_linuxMatch12.04-

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch16.04esm

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch19.04

canonicalubuntu_linuxMatch19.10

Node

appleicloudRange<7.13windows

appleicloudRange10.0–10.6windows

appleitunesRange<12.9.6windows

appleiphone_osRange<12.4

applemac_os_xMatch10.12.6security_update_2019-001

applemac_os_xMatch10.12.6security_update_2019-002

applemac_os_xMatch10.12.6security_update_2019-003

applemac_os_xMatch10.13.6security_update_2019-001

applemac_os_xMatch10.13.6security_update_2019-002

applemac_os_xMatch10.13.6security_update_2019-003

applemacosRange10.4.6–10.14.6

appletvosRange<12.4

VendorProductVersionCPE
xmlsoftlibxslt1.1.33cpe:2.3:a:xmlsoft:libxslt:1.1.33:*:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netappcloud_backup-cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netappclustered_data_ontap-cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
netappe-series_performance_analyzer-cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
netappe-series_santricity_management_plug-ins-cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:*
netappe-series_santricity_os_controller*cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
netappe-series_santricity_storage_manager-cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
xmlsoft	libxslt	1.1.33	cpe:2.3:a:xmlsoft:libxslt:1.1.33:::::::*
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
netapp	cloud_backup	-	cpe:2.3:a:netapp:cloud_backup:-:::::::*
netapp	clustered_data_ontap	-	cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*
netapp	e-series_performance_analyzer	-	cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::*
netapp	e-series_santricity_management_plug-ins	-	cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:::::vmware_vcenter::
netapp	e-series_santricity_os_controller	*	cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::
netapp	e-series_santricity_storage_manager	-	cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:::::::*

Rows per page:

1-10 of 361

References

lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html

seclists.org/fulldisclosure/2019/Aug/11

seclists.org/fulldisclosure/2019/Aug/13

seclists.org/fulldisclosure/2019/Aug/14

seclists.org/fulldisclosure/2019/Aug/15

seclists.org/fulldisclosure/2019/Jul/22

seclists.org/fulldisclosure/2019/Jul/23

seclists.org/fulldisclosure/2019/Jul/24

seclists.org/fulldisclosure/2019/Jul/26

seclists.org/fulldisclosure/2019/Jul/31

seclists.org/fulldisclosure/2019/Jul/37

seclists.org/fulldisclosure/2019/Jul/38

www.openwall.com/lists/oss-security/2019/11/17/2

bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069

gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

lists.debian.org/debian-lts-announce/2019/07/msg00020.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/

oss-fuzz.com/testcase-detail/5197371471822848

seclists.org/bugtraq/2019/Aug/21

seclists.org/bugtraq/2019/Aug/22

seclists.org/bugtraq/2019/Aug/23

seclists.org/bugtraq/2019/Aug/25

seclists.org/bugtraq/2019/Jul/35

seclists.org/bugtraq/2019/Jul/36

seclists.org/bugtraq/2019/Jul/37

seclists.org/bugtraq/2019/Jul/40

seclists.org/bugtraq/2019/Jul/41

seclists.org/bugtraq/2019/Jul/42

security.netapp.com/advisory/ntap-20190806-0004/

security.netapp.com/advisory/ntap-20200122-0003/

support.apple.com/kb/HT210346

support.apple.com/kb/HT210348

support.apple.com/kb/HT210351

support.apple.com/kb/HT210353

support.apple.com/kb/HT210356

support.apple.com/kb/HT210357

support.apple.com/kb/HT210358

usn.ubuntu.com/4164-1/

www.oracle.com/security-alerts/cpujan2020.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.004

Percentile

72.7%

JSON

Related for NVD:CVE-2019-13118