Bug 10263

Summary: libxslt security vulnerabilities CVE-2019-13117 , CVE-2019-13118 , CVE-2019-18197
Product: [ROSA-based products] ROSA Fresh Reporter: Zombie Ryushu <zombie.ryushu>
Component: Packages from MainAssignee: ROSA Linux Bugs <bugs>
Status: RESOLVED DUPLICATE QA Contact: ROSA Linux Bugs <bugs>
Severity: normal    
Priority: Normal CC: alzim, andrey.bondrov, denis.silakov, mc2374
Version: All   
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: https://advisories.mageia.org/MGASA-2019-0313.html
Whiteboard:
Platform: --- ROSA Vulnerability identifier: CVE-2019-13117 , CVE-2019-13118 , CVE-2019-18197
RPM Package: libxslt ISO-related:
Bad POT generating: Upstream:

Description Zombie Ryushu 2019-11-06 18:31:02 MSK 
* In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
  could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
  could allow an attacker to discern whether a byte on the stack contains
  the characters A, a, I, i, or 0, or any other character (CVE-2019-13117).

* In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
  xsl:number instruction was too narrow and an invalid character/length
  combination could be passed to xsltNumberFormatDecimal, leading to a read
  of uninitialized stack data (CVE-2019-13118).

* In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
  reset under certain circumstances. If the relevant memory area happened to
  be freed and reused in a certain way, a bounds check could fail and memory
  outside a buffer could be written to, or uninitialized data could be
  disclosed (CVE-2019-18197).
Comment 1 Andrey Bondrov 2019-11-07 04:31:01 MSK 

*** This bug has been marked as a duplicate of bug 10251 ***