SB2019041741 - Permissions, Privileges, and Access Controls in libxslt (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019041741

SB2019041741 - Permissions, Privileges, and Access Controls in libxslt (Alpine package)

Published: April 17, 2019

Security Bulletin ID SB2019041741
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-11068)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to an error within the xsltCheckRead() and xsltCheckWrite() functions when processing requests from remote servers. A remote attacker can trick the victim into opening a specially crafted URL that will result in "-1 error" code but the URL itself will be processed by the application later.

Successful exploitation of the vulnerability may allow an attacker to bypass certain security restrictions and perform XXE attacks.

Remediation

Install update from vendor's website.

References