#VU18965 Information disclosure in libxslt - CVE-2019-13117
Published: July 2, 2019 / Updated: October 19, 2019
Vulnerability identifier: #VU18965
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-13117
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
libxslt
libxslt
Software vendor:
Gnome Development Team
Gnome Development Team
Description
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to information disclosure in numbers.c in libxslt library where an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. A remote attacker can gain knowledge whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.