Skip to content
OpenAdvisories
Medium ELSA-2020-4464 2 CVEs

Moderate: libxslt security update (Oracle Linux 8)

Published Nov 10, 2020 · Updated Nov 10, 2020

Ecosystem: Oracle Linux

Summary

[1.1.32-5.0.1]
- Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball

[1.1.32-5]
- Fix CVE-2019-18197 (#1775517)
- Fix CVE-2019-11068 (#1715732)

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 libxslt 0:1.1.32-5.0.1.el8
Oracle Linux · 8 libxslt-devel 0:1.1.32-5.0.1.el8

Vulnerabilities 2

  • Critical 9.8
    CVE-2019-11068

    Nokogiri vulnerable to libxslt protection mechanism bypass

    libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequentl…

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-18197

    Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems