Skip to content
OpenAdvisories
Critical RHSA-2020:4464 2 CVEs

Red Hat Security Advisory: libxslt security update

Published Sep 18, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream libxslt-debuginfo 0:1.1.32-5.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libxslt-debugsource 0:1.1.32-5.el8
Red Hat · RHEL 8 enterprise_linux:8::appstream libxslt-devel 0:1.1.32-5.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos libxslt 0:1.1.32-5.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos libxslt-debuginfo 0:1.1.32-5.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos libxslt-debugsource 0:1.1.32-5.el8

Vulnerabilities 2

  • Critical 9.8
    CVE-2019-11068

    Nokogiri vulnerable to libxslt protection mechanism bypass

    libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequentl…

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2019-18197

    Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written …

    nokogiri libxslt libxslt libxslt Debian Ubuntu Alpine RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1709697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1770768
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4464.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11068
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11068
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11068
  • report
    https://access.redhat.com/security/cve/CVE-2019-18197
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-18197
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-18197