Use-After-Free Vulnerability in libxslt: CVE-2024-55549
Summary
CVE-2024-55549: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. Affects libxslt across 2 version ranges.
< 1.1.38-r1
< 71be7a32637760d769b193d95e0c745ecb86b679
Fixed in 1.1.38-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxslt is a widely used library for transforming XML documents using XSLT (Extensible Stylesheet Language Transformations). It provides a powerful and efficient way to convert XML data into various formats, making it essential for applications that rely on XML processing. However, prior to version 1.1.43, libxslt is susceptible to a use-after-free vulnerability that can lead to unexpected behavior and potential security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-55549 arises from a use-after-free issue in the function xsltGetInheritedNsList within libxslt versions before 1.1.43. This flaw is related to the improper handling of result prefixes, which can allow an attacker to exploit the vulnerability, potentially leading to arbitrary code execution or application crashes. The technical implications of this vulnerability highlight the importance of proper memory management in software development, particularly in libraries that handle complex data structures like XML.
How To Fix
Minimum fixed version
1.1.38-r1
This is the first release that contains the fix.
sudo apk add --upgrade libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider avoiding the use of features that rely on the affected function until the package can be updated. However, this is not a long-term solution and updating the package is strongly advised.
Conclusion
CVE-2024-55549 represents a significant security risk for applications using libxslt versions prior to 1.1.43 due to a use-after-free vulnerability. It is essential for users to update to the latest version to protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for libxslt →
FAQ
CVE-2024-55549 is a use-after-free vulnerability found in libxslt versions prior to 1.1.43, which can lead to security risks such as arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploiting this vulnerability may allow attackers to execute arbitrary code or crash applications that utilize the affected libxslt library.
Yes, the patch is available in libxslt version 1.1.43 and later. It is crucial to update to this version to mitigate the vulnerability.
Using tools like Vulert, you can receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
