Summary
[1.1.28-6.0.1]
- Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball
[1.1.28-6]
- Fix CVE-2019-18197 (#1775516)
- Fix CVE-2019-11068 (#1715731)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | libxslt | 0:1.1.28-6.0.1.el7 |
| Oracle Linux · 7 | libxslt-devel | 0:1.1.28-6.0.1.el7 |
| Oracle Linux · 7 | libxslt-python | 0:1.1.28-6.0.1.el7 |
Vulnerabilities 2
-
Critical 9.8
Nokogiri vulnerable to libxslt protection mechanism bypass
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequentl…
-
High 7.5
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …