Use-After-Free Vulnerability in libxslt: Critical Security Flaw
Summary
ALPINE-CVE-2024-55549: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. Affects libxslt versions < 1.1.38-r1. Fixed in 1.1.38-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxslt is a widely used library for transforming XML documents into various formats using XSLT (Extensible Stylesheet Language Transformations). It provides essential functionalities for XML processing, making it a critical component in many applications that rely on XML data. However, prior to version 1.1.43, libxslt was susceptible to a use-after-free vulnerability, which could lead to potential security risks.
Vulnerability Detail
The vulnerability, identified as ALPINE-CVE-2024-55549, arises from a flaw in the xsltGetInheritedNsList function within libxslt versions before 1.1.43. This issue is characterized by a use-after-free condition that occurs when the function improperly handles memory management related to the exclusion of result prefixes. Attackers could exploit this vulnerability to execute arbitrary code, leading to unauthorized access or manipulation of sensitive data.
How To Fix
Minimum fixed version
1.1.38-r1
This is the first release that contains the fix.
sudo apk add --upgrade libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function or limit the use of libxslt in their applications until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The use-after-free vulnerability in libxslt poses significant security risks to applications that rely on this library for XML processing. It is crucial for users to update to the latest patched versions to safeguard their systems against potential exploits. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for libxslt →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to unexpected behavior or security breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can receive real-time alerts about vulnerabilities, including this one.
Exploiting this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized access, data corruption, or system compromise.
While the best practice is to update to a patched version, you can temporarily limit the use of the affected functions in your application as a workaround.
Detailed information about this vulnerability can be found in the official Alpine security advisories and on platforms like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
