What’s Vulnerable › Vulnerabilities

CVE-2019-13118: libxslt Type Confusion vulnerability that affects Nokogiri

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-01 · updated 2026-06-17
• Weakness: CWE-843

Description

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

Affected products

• Apple iCloud for Windows: before 7.13; from 10.0 before 10.6 — fixed in 10.6, 7.13
• Apple Iphone Os: before 12.4 — fixed in 12.4
• Apple iTunes for Windows: before 12.9.6 — fixed in 12.9.6
• macOS: 10.12.6-security_update_2019-001, 10.12.6-security_update_2019-002, 10.12.6-security_update_2019-003, 10.13.6-security_update_2019-001, 10.13.6-security_update_2019-002, 10.13.6-security_update_2019-003
• Apple macOS: from 10.4.6 before 10.14.6 — fixed in 10.14.6
• Apple tvOS: before 12.4 — fixed in 12.4
• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04, 19.10
• Fedoraproject Fedora: 31
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Cloud Backup: all versions
• Clustered Data ONTAP: all versions
• NetApp E-Series Performance Analyzer: all versions
• NetApp E-Series Santricity Management Plug-Ins: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.50.2
• NetApp E-Series Santricity Storage Manager: all versions
• NetApp E-Series Santricity Web Services: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Plug-In For Symantec Netbackup: all versions
• NetApp Santricity Unified Manager: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• openSUSE Leap: 15.1
• Oracle Java SE: 1.8.0-update231
• xmlsoft libxslt: 1.1.33
• Rubygems Nokogiri: before 1.10.5; 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+108) — fixed in 1.10.5

How to fix

Upgrade to a fixed version: Apple iCloud for Windows 10.6, 7.13; Apple Iphone Os 12.4; Apple iTunes for Windows 12.9.6; Apple macOS 10.14.6; Apple tvOS 12.4; Rubygems Nokogiri 1.10.5. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
• http://seclists.org/fulldisclosure/2019/Aug/11
• http://seclists.org/fulldisclosure/2019/Aug/13
• http://seclists.org/fulldisclosure/2019/Aug/14
• http://seclists.org/fulldisclosure/2019/Aug/15
• http://seclists.org/fulldisclosure/2019/Jul/22
• http://seclists.org/fulldisclosure/2019/Jul/23
• http://seclists.org/fulldisclosure/2019/Jul/24
• http://seclists.org/fulldisclosure/2019/Jul/26
• http://seclists.org/fulldisclosure/2019/Jul/31
• http://seclists.org/fulldisclosure/2019/Jul/37
• http://seclists.org/fulldisclosure/2019/Jul/38

Get alerted when CVE-2019-13118 or the next vulnerability affects your stack