Vulnerability CVE-2019-11068: Information

Description

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-11068
Published: April 10, 2019
Modified: Nov. 7, 2023

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
libxsltsisyphus1.1.33-alt21.1.39-alt1ALT-PU-2019-2688-1237506Fixed
libxsltp101.1.33-alt21.1.34-alt3ALT-PU-2019-2688-1237506Fixed
libxsltp91.1.34-alt1.p9.11.1.34-alt1.p9.1ALT-PU-2020-3348-1261811Fixed
libxsltc10f11.1.33-alt21.1.37-alt1ALT-PU-2019-2688-1237506Fixed
libxsltc9f21.1.34-alt1.p9.11.1.34-alt3ALT-PU-2020-3302-1261812Fixed
libxsltp111.1.33-alt21.1.39-alt1ALT-PU-2019-2688-1237506Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
  • Patch
  • Third Party Advisory
[debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security update
  • Mailing List
  • Third Party Advisory
USN-3947-2
  • Third Party Advisory
[oss-security] 20190422 Nokogiri security update v1.10.3
  • Mailing List
  • Third Party Advisory
USN-3947-1
  • Third Party Advisory
[oss-security] 20190423 Re: Nokogiri security update v1.10.3
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:1433
  • Third Party Advisory
openSUSE-SU-2019:1430
  • Third Party Advisory
openSUSE-SU-2019:1428
  • Third Party Advisory
openSUSE-SU-2019:1527
  • Third Party Advisory
openSUSE-SU-2019:1824
  • Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
  • Patch
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20191017-0001/
  • Third Party Advisory
FEDORA-2019-e21c77ffae
    FEDORA-2019-320d5295fc
      FEDORA-2019-e74d639587

          1. Configuration 1

            cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*
            End including
            1.1.33

            Configuration 2

            cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
            cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
            cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
            cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
            cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

            Configuration 3

            cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

            Configuration 4

            cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
            cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

            Configuration 5

            cpe:2.3:a:oracle:jdk:8.0:update_221:*:*:*:*:*:*

            Configuration 6

            cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
            cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*
            cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
            cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:*
            cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*
            cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
            cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
            Start including
            11.0
            End including
            11.70.2

            Configuration 7

            cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
            cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
            cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
        VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
        Version: v24.5.3
        Back to top