CVE-2019-18197

NameCVE-2019-18197
DescriptionIn xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1973-1
NVD severitymedium
Debian Bugs942646

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxslt (PTS)jessie1.1.28-2+deb8u3vulnerable
jessie (security)1.1.28-2+deb8u6fixed
stretch1.1.29-2.1+deb9u1vulnerable
buster1.1.32-2.2~deb10u1fixed
bullseye, sid1.1.32-2.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxsltsource(unstable)1.1.32-2.2942646
libxsltsourcebuster1.1.32-2.2~deb10u1
libxsltsourcejessie1.1.28-2+deb8u6DLA-1973-1

Notes

[stretch] - libxslt <no-dsa> (Minor issue)
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914
https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285

Search for package or bug name: Reporting problems