XMLSoft libxslt 1.1.33 Release Candidate 2

CPE Details

XMLSoft libxslt 1.1.33 Release Candidate 2
xmlsoft
libxslt
1.1.33
2019-02-27
18h44 +00:00
2019-02-27
18h44 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:xmlsoft:libxslt:1.1.33:rc2:*:*:*:*:*:*

Informations

Vendor

xmlsoft

Product

libxslt

Version

1.1.33

Update

rc2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-29824 2022-05-02 22h00 +00:00 In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
6.5
Moyen
CVE-2021-30560 2021-08-02 22h00 +00:00 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
8.8
Haute
CVE-2019-18197 2019-10-18 18h07 +00:00 In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
7.5
Haute
CVE-2019-13118 2019-06-30 23h27 +00:00 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
5.3
Moyen
CVE-2019-13117 2019-06-30 23h27 +00:00 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
5.3
Moyen
CVE-2019-11068 2019-04-10 17h38 +00:00 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
9.8
Critique