CVE-2019-13118

Published Jul 1, 2019

Last updated 11 days ago

Overview

Description
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
Source
cve@mitre.org
NVD status
Modified
Products
libxslt, leap, active_iq_unified_manager, cloud_backup, clustered_data_ontap, e-series_performance_analyzer, e-series_santricity_management_plug-ins, e-series_santricity_os_controller, e-series_santricity_storage_manager, e-series_santricity_web_services, oncommand_insight, oncommand_workflow_automation, ontap_select_deploy_administration_utility, plug-in_for_symantec_netbackup, santricity_unified_manager, steelstore_cloud_integrated_storage, jdk, fedora, ubuntu_linux, icloud, itunes, iphone_os, mac_os_x, macos, tvos

Risk scores

CVSS 3.1

Type
Primary
Base score
5.3
Impact score
1.4
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
5
Impact score
2.9
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov
CWE-843
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-843

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.