Summary
USN-5575-1 fixed vulnerabilities in Libxslt. This update provides
the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04
ESM.
Original advisory details:
Nicolas Grégoire discovered that Libxslt incorrectly handled certain XML.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2019-5815)
Alexey Neyman incorrectly handled certain HTML pages.
An attacker could possibly use this issue to expose sensitive information
or execute arbitrary code. (CVE-2021-30560)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libxslt | 1.1.28-2ubuntu0.2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxslt | 1.1.28-2.1ubuntu0.3+esm1 |
Vulnerabilities 2
-
High 8.8CVE-2021-30560 EPSS 20%
Nokogiri has vulnerable dependencies on libxml2 and libxslt
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
-
High 7.5
Nokogiri implementation of libxslt vulnerable to heap corruption
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.