Critical Vulnerability in libxslt: Uninitialized Stack Data Exposure
Summary
ALPINE-CVE-2019-13118: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of... Affects libxslt versions < 1.1.33-r3. Fixed in 1.1.33-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxslt is a widely-used library for transforming XML documents into various formats using XSLT (Extensible Stylesheet Language Transformations). It is known for its performance and compliance with standards, making it a popular choice among developers. However, a vulnerability has been identified in version 1.1.33 that compromises its security, specifically related to the handling of grouping characters in the xsl:number instruction.
Vulnerability Detail
In numbers.c of libxslt version 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow, allowing an invalid character or length combination to be passed to the xsltNumberFormatDecimal function. This flaw can lead to a read of uninitialized stack data, potentially exposing sensitive information and impacting the confidentiality of the application. The vulnerability is tracked under CVE-2019-13118 and has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.1.33-r3
This is the first release that contains the fix.
sudo apk add --upgrade libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to ensure that only valid characters and lengths are passed to the xsl:number instruction. This can help mitigate the risk of uninitialized data exposure until the package can be updated.
Conclusion
The vulnerability in libxslt poses a significant risk due to the potential exposure of sensitive data through uninitialized stack reads. It is crucial for users to update to the patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for libxslt →
FAQ
CVE-2019-13118 is a vulnerability in libxslt that allows for the reading of uninitialized stack data due to improper handling of grouping characters in the xsl:number instruction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
The vulnerability has a CVSS score of 5.3, indicating a moderate level of severity.
Implement input validation to restrict the characters and lengths passed to the xsl:number instruction as a temporary workaround until you can apply the patch.
Versions of libxslt prior to 1.1.34 are affected, specifically 1.1.33 and earlier versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
