Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-13118

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

Published

2019-07-01T02:15:09.800

Last Modified

2024-11-21T04:24:13.817

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-843

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	xmlsoft	libxslt	1.1.33	Yes
Operating System	opensuse	leap	15.1	Yes
Application	netapp	active_iq_unified_manager	-	Yes
Application	netapp	active_iq_unified_manager	-	Yes
Application	netapp	cloud_backup	-	Yes
Application	netapp	clustered_data_ontap	-	Yes
Application	netapp	e-series_performance_analyzer	-	Yes
Application	netapp	e-series_santricity_management_plug-ins	-	Yes
Application	netapp	e-series_santricity_os_controller	≤ 11.50.2	Yes
Application	netapp	e-series_santricity_storage_manager	-	Yes
Application	netapp	e-series_santricity_web_services	-	Yes
Application	netapp	oncommand_insight	-	Yes
Application	netapp	oncommand_workflow_automation	-	Yes
Application	netapp	ontap_select_deploy_administration_utility	-	Yes
Application	netapp	plug-in_for_symantec_netbackup	-	Yes
Application	netapp	santricity_unified_manager	-	Yes
Application	netapp	steelstore_cloud_integrated_storage	-	Yes
Application	oracle	jdk	1.8.0	Yes
Operating System	fedoraproject	fedora	31	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Operating System	canonical	ubuntu_linux	16.04	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes
Operating System	canonical	ubuntu_linux	19.04	Yes
Operating System	canonical	ubuntu_linux	19.10	Yes
Application	apple	icloud	< 7.13	Yes
Application	apple	icloud	< 10.6	Yes
Application	apple	itunes	< 12.9.6	Yes
Operating System	apple	iphone_os	< 12.4	Yes
Operating System	apple	mac_os_x	10.12.6	Yes
Operating System	apple	mac_os_x	10.12.6	Yes
Operating System	apple	mac_os_x	10.12.6	Yes
Operating System	apple	mac_os_x	10.13.6	Yes
Operating System	apple	mac_os_x	10.13.6	Yes
Operating System	apple	mac_os_x	10.13.6	Yes
Operating System	apple	macos	< 10.14.6	Yes
Operating System	apple	tvos	< 12.4	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Aug/11 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Aug/13 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Aug/14 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Aug/15 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/22 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/23 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/24 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/26 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/31 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/37 Mailing List, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2019/Jul/38 Mailing List, Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2019/11/17/2 Mailing List, Third Party Advisory ([email protected])
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069 Permissions Required ([email protected])
https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b Patch, Third Party Advisory ([email protected])
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E ([email protected])
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E ([email protected])
https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/ ([email protected])
https://oss-fuzz.com/testcase-detail/5197371471822848 Permissions Required ([email protected])
https://seclists.org/bugtraq/2019/Aug/21 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Aug/22 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Aug/23 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Aug/25 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/35 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/36 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/37 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/40 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/41 Mailing List, Third Party Advisory ([email protected])
https://seclists.org/bugtraq/2019/Jul/42 Mailing List, Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20190806-0004/ Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20200122-0003/ Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210346 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210348 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210351 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210353 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210356 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210357 Third Party Advisory ([email protected])
https://support.apple.com/kb/HT210358 Third Party Advisory ([email protected])
https://usn.ubuntu.com/4164-1/ Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Aug/11 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Aug/13 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Aug/14 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Aug/15 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/22 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/23 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/24 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/26 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/31 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/37 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2019/Jul/38 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2019/11/17/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/ (af854a3a-2127-422b-91ae-364da2661108)
https://oss-fuzz.com/testcase-detail/5197371471822848 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Aug/21 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Aug/22 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Aug/23 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Aug/25 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/35 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/36 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/37 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/40 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/41 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://seclists.org/bugtraq/2019/Jul/42 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20190806-0004/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20200122-0003/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210346 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210348 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210351 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210353 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210356 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210357 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.apple.com/kb/HT210358 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/4164-1/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)