Advisory Weakness Curation

Nokogiri implementation of libxslt vulnerable to heap corruption Type confusion in `xsltNumberFormatGetMultipleLevel` prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.

Access of Resource Using Incompatible Type (Type Confusion) Type confusion in `xsltNumberFormatGetMultipleLevel` in libxslt, which is included in nokogiri, could allow attackers to potentially exploit heap corruption via crafted XML data.