Summary
Nicolas Grégoire discovered that Libxslt incorrectly handled certain XML.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-5815)
Alexey Neyman incorrectly handled certain HTML pages.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. (CVE-2021-30560)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | libxslt | 1.1.29-5ubuntu0.3 |
| Ubuntu · 20.04 LTS 20.04:LTS | libxslt | 1.1.34-4ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | libxslt | 1.1.34-4ubuntu0.22.04.1 |
Vulnerabilities 2
-
High 8.8CVE-2021-30560 EPSS 20%
Nokogiri has vulnerable dependencies on libxml2 and libxslt
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
-
High 7.5
Nokogiri implementation of libxslt vulnerable to heap corruption
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.