~ / search / GHSA-4hm9-844j-jmxp

GHSA-4hm9-844j-jmxp

Uninitialized read in Nokogiri gem

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-13117

Packages

EcosystemPackageAffectedFixed in
RubyGems nokogiri < 1.10.5 1.10.5

Details

As written in the advisory (Markdown source, shown as plain text).

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

References

External links from the advisory. They lead to third-party sites.