Skip to content
OpenAdvisories
Medium DLA-1860-1 4 CVEs

libxslt - security update

Published Jul 22, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 libxslt 1.1.28-2+deb8u5

Vulnerabilities 4

  • Medium 5.3
    CVE-2019-13117

    Uninitialized read in Nokogiri gem

    In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any…

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems
  • Medium 5.3
    CVE-2019-13118

    libxslt Type Confusion vulnerability that affects Nokogiri

    In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2016-4609

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows…

    libxslt libxslt Debian Ubuntu
  • Unscored —
    CVE-2016-4610

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows…

    libxslt libxslt Debian Ubuntu