GitHub Advisoryadvisory · RubyGems

GHSA-vmfx-gcfq-wvm2 Nokogiri implementation of libxslt vulnerable to heap corruption

HIGH Published 2022-05-24 Modified 2023-07-10 Official page ↗
Aliases
CVE-2019-5815
Ecosystem
RubyGems
Packages
nokogiri
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-787, CWE-843
Reviewed
2023-07-07

Affected packages

• RubyGems nokogiri: < 1.10.5 → fixed in 1.10.5

Description

Type confusion in `xsltNumberFormatGetMultipleLevel` prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.

Related

Alias · CVE (1)

  • CVE-2019-5815 Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via… vulnerability

Weakness · CWE (2)

  • CWE-787 Out-of-bounds Write weakness
  • CWE-843 Access of Resource Using Incompatible Type weakness

References