Lucene search

K
mageiaGentoo FoundationMGASA-2019-0313
HistoryNov 02, 2019 - 7:54 p.m.

Updated libxslt packages fix security vulnerabilities

2019-11-0219:54:34
Gentoo Foundation
advisories.mageia.org
25

0.008 Low

EPSS

Percentile

81.5%

Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117). * In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118). * In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn’t reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchlibxslt< 1.1.33-2.1libxslt-1.1.33-2.1.mga7