Skip to content
OpenAdvisories
Critical RHSA-2020:4005 2 CVEs

Red Hat Security Advisory: libxslt security update

Published Sep 18, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client libxslt 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::client libxslt-debuginfo 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::client libxslt-devel 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::client libxslt-python 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode libxslt 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode libxslt-debuginfo 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode libxslt-devel 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode libxslt-python 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::server libxslt 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::server libxslt-debuginfo 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::server libxslt-devel 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::server libxslt-python 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation libxslt 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation libxslt-debuginfo 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation libxslt-devel 0:1.1.28-6.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation libxslt-python 0:1.1.28-6.el7

Vulnerabilities 2

  • Critical 9.8
    CVE-2019-11068

    Nokogiri vulnerable to libxslt protection mechanism bypass

    libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequentl…

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-18197

    Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1709697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1770768
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4005.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11068
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11068
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11068
  • report
    https://access.redhat.com/security/cve/CVE-2019-18197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-18197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-18197