Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18197: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed. 1770768: CVE-2019-18197 libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure CVE-2019-11068: libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded. 1709697: CVE-2019-11068 libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxslt | 0:1.1.28-6.amzn2 |
| Amazon Linux · 2 | libxslt-debuginfo | 0:1.1.28-6.amzn2 |
| Amazon Linux · 2 | libxslt-devel | 0:1.1.28-6.amzn2 |
| Amazon Linux · 2 | libxslt-python | 0:1.1.28-6.amzn2 |
Vulnerabilities 2
-
Critical 9.8
Nokogiri vulnerable to libxslt protection mechanism bypass
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequentl…
-
High 7.5
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …