GitHub Advisoryadvisory · RubyGems

GHSA-4hm9-844j-jmxp Uninitialized read in Nokogiri gem

MEDIUM Published 2022-05-24 Modified 2026-06-10 Official page ↗
Aliases
CVE-2019-13117
Ecosystem
RubyGems
Packages
nokogiri
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-908
Reviewed
2023-06-09

Affected packages

• RubyGems nokogiri: < 1.10.5 → fixed in 1.10.5

Description

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

Related

Alias · CVE (1)

  • CVE-2019-13117 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in… vulnerability

Weakness · CWE (1)

  • CWE-908 Use of Uninitialized Resource weakness

References