~ / search / GHSA-cf46-6xxh-pc75

GHSA-cf46-6xxh-pc75

libxslt Type Confusion vulnerability that affects Nokogiri

Source: GitHub Advisory Database (reviewed) High CVE-2019-13118

Packages

EcosystemPackageAffectedFixed in
RubyGems nokogiri < 1.10.5 1.10.5

Details

As written in the advisory (Markdown source, shown as plain text).

In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data. Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.

References

External links from the advisory. They lead to third-party sites.