VulnerableCode Package Details - pkg:deb/ubuntu/libxslt@1.1.29-1ubuntu0.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-1px9-q7g4-aaan Aliases: CVE-2019-11068 GHSA-qxcg-xjjg-66mj	libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.	1.1.29-5ubuntu0.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-2em3-ugp2-aaag Aliases: CVE-2019-13117 GHSA-4hm9-844j-jmxp	In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.	1.1.29-5ubuntu0.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-57tk-3v58-aaaj Aliases: CVE-2019-13118 GHSA-cf46-6xxh-pc75	In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.	1.1.29-5ubuntu0.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-76fj-htxj-aaah Aliases: CVE-2019-18197 GHSA-242x-7cm6-4w8j	In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.	1.1.33-0ubuntu1.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1px9-q7g4-aaan
Aliases:
CVE-2019-11068
GHSA-qxcg-xjjg-66mj

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

1.1.29-5ubuntu0.1
Affected by 3 other vulnerabilities.

VCID-2em3-ugp2-aaag
Aliases:
CVE-2019-13117
GHSA-4hm9-844j-jmxp

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

1.1.29-5ubuntu0.2
Affected by 1 other vulnerability.

VCID-57tk-3v58-aaaj
Aliases:
CVE-2019-13118
GHSA-cf46-6xxh-pc75

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

1.1.29-5ubuntu0.2
Affected by 1 other vulnerability.

VCID-76fj-htxj-aaah
Aliases:
CVE-2019-18197
GHSA-242x-7cm6-4w8j

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

1.1.33-0ubuntu1.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Next non-vulnerable version	1.1.33-0ubuntu1.1
Latest non-vulnerable version	1.1.33-0ubuntu1.1
Risk	4.5