CVE-2019-8119

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...

[SECURITY] Fedora 31 Update: libxslt-1.1.33-4.fc31

This C library allows to transform XML files into other XML files or HTML, text, ... using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 =3D 2.6.27 installed. The xsltproc command is a command line interface to the XSLT eng ine...

Debian: Security Advisory (DLA-1973-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PRODSECBUG-2449: Remote code execution via local file delete and XSLT injection

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

WebKit Universal Cross Site Scripting

WebKit: UXSS via XSLT and nested document replacements Related CVE Numbers: CVE-2019-8690Id-714702681. VULNERABILITY DETAILS https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cppL66 Ref XSLTProcessor::createDocumentFromSourceconst String& sourceString, const String&...

WebKit - UXSS via XSLT and Nested Document Replacements Exploit

VULNERABILITY DETAILS https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cppL66 Ref XSLTProcessor::createDocumentFromSourceconst String& sourceString, const String& sourceEncoding, const String& sourceMIMEType, Node sourceNode, Frame frame Ref...

WebKit - UXSS via XSLT and Nested Document Replacements

VULNERABILITY DETAILS https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cppL66 Ref XSLTProcessor::createDocumentFromSourceconst String& sourceString, const String& sourceEncoding, const String& sourceMIMEType, Node sourceNode, Frame frame Ref...

libxslt/xslt: Use-of-uninitialized-value in xmlOutputBufferWriteEscape

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5768945878958080 Project: libxslt Fuzzer: libFuzzerlibxsltxslt Fuzz target binary: xslt Job Type: libfuzzermsanlibxslt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

Solaris 10 (x86) : 125732-15

SunOS 5.10x86: XML and XSLT libraries patch. Date this patch was last updated by Sun : Jul/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid126727; scriptversion"1.3";...

Solaris 10 (sparc) : 125731-15

SunOS 5.10: XML and XSLT libraries patch. Date this patch was last updated by Sun : Jul/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid126717; scriptversion"1.3";...

CVE-2019-13117

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character...

[SECURITY] Fedora 29 Update: libxslt-1.1.33-1.fc29

This C library allows to transform XML files into other XML files or HTML, text, ... using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 =3D 2.6.27 installed. The xsltproc command is a command line interface to the XSLT eng ine...

Fedora Update for mingw-libxslt FEDORA-2019-320d5295fc

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: mingw-libxslt-1.1.33-1.fc30

This C library allows to transform XML files into other XML files or HTML, text, ... using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 =3D 2.6.27 installed. The xsltproc command is a command line interface to the XSLT eng ine...

[SECURITY] Fedora 30 Update: libxslt-1.1.33-1.fc30

This C library allows to transform XML files into other XML files or HTML, text, ... using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 =3D 2.6.27 installed. The xsltproc command is a command line interface to the XSLT eng ine...

chromium-browser: Heap buffer overflow in Blink

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data...

Use After Free

Thunderbird, Firefox ESR, and Firefox are vulnerable to use-after-free vulnerability. Objects being used when they no longer exist during XSLT processing may cause the application to crash resulting in denial of service conditions. The affected component is XSLT Handler...

Use After Free

Thunderbird, Firefox ESR, and Firefox are vulnerable to use-after-free vulnerability. XSLT processing due to poor handling of template parameters may cause the application to crash causing denial of service...

Use After Free

Thunderbird, Firefox ESR, and Firefox are vulnerable to use-after-free vulnerability. XSLT processing due to the result handler being held by a freed handler during handling may cause the application to crash...

Use After Free

Firefox is vulnerable to use-after-free attacks. This occurs in XSL when processing XSLT documents which leads to memory corruption which allow attackers to crash the application and case a denial of service...