GitHub Advisoryadvisory · RubyGems

GHSA-cf46-6xxh-pc75 libxslt Type Confusion vulnerability that affects Nokogiri

HIGH Published 2022-05-24 Modified 2026-06-09 Official page ↗
Aliases
CVE-2019-13118
Ecosystem
RubyGems
Packages
nokogiri
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-843
Reviewed
2023-03-08

Affected packages

• RubyGems nokogiri: < 1.10.5 → fixed in 1.10.5

Description

In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data. Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.

Related

Alias · CVE (1)

  • CVE-2019-13118 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid… vulnerability

Weakness · CWE (1)

  • CWE-843 Access of Resource Using Incompatible Type weakness

References