CVE-2019-13117.yml

---
gem: nokogiri
cve: 2019-13117
ghsa: 4hm9-844j-jmxp
url: https://github.com/sparklemotion/nokogiri/issues/1943
title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
date: 2019-10-31
description: |
  Nokogiri v1.10.5 has been released.

  This is a security release. It addresses three CVEs in upstream libxml2,
  for which details are below.

  If you're using your distro's system libraries, rather than Nokogiri's
  vendored libraries, there's no security need to upgrade at this time,
  though you may want to check with your distro whether they've patched this
  (Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
  these vulnerabilities.

  Full details about the security update are available in Github Issue
  [#1943] https://github.com/sparklemotion/nokogiri/issues/1943.

  ---

  CVE-2019-13117

  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html

  Priority: Low

  Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
  could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
  could allow an attacker to discern whether a byte on the stack contains the
  characters A, a, I, i, or 0, or any other character.

  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1

  ---

  CVE-2019-13118

  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html

  Priority: Low

  Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
  xsl:number instruction was too narrow and an invalid character/length
  combination could be passed to xsltNumberFormatDecimal, leading to a read
  of uninitialized stack data

  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

  ---

  CVE-2019-18197

  https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html

  Priority: Medium

  Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
  reset under certain circumstances. If the relevant memory area happened to
  be freed and reused in a certain way, a bounds check could fail and memory
  outside a buffer could be written to, or uninitialized data could be
  disclosed.

  Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
patched_versions:
  - ">= 1.10.5"
related:
  cve:
    - 2019-13118
    - 2019-18197
  url:
    - https://groups.google.com/d/msg/ruby-security-ann/-Wq4aouIA3Q/yc76ZHemBgAJ
    - https://usn.ubuntu.com/4164-1/
    - https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1
    - https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
    - https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285