CVE-2019-5815 — Out-of-bounds Write in Libxslt

CWE-787 — Out-of-bounds Write CWE-843 — Type Confusion14 documents8 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 70.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Xmlsoft Libxslt +2 more

Timeline

PublishedDec 11

Latest updateAug 22

Description

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDxmlsoft/libxslt< 1.1.33

▶Debianxmlsoft/libxslt< 1.1.34-2+3

▶Ubuntuxmlsoft/libxslt< 1.1.29-5ubuntu0.3+4

▶CVEListV5google/chromeunspecified — 74.0.3729.108

▶RubyGemsnokogiri/nokogiri< 1.10.5

Also affects: Debian Linux 10.0

🔴Vulnerability Details

OSV

libxslt vulnerabilities↗2022-08-22

▶

OSV

libxslt vulnerabilities↗2022-08-22

▶

GHSA

Nokogiri implementation of libxslt vulnerable to heap corruption↗2022-05-24

▶

OSV

Nokogiri implementation of libxslt vulnerable to heap corruption↗2022-05-24

▶

CVEList

CVE-2019-5815: Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1↗2019-12-11

▶

📋Vendor Advisories

Ubuntu

Libxslt vulnerabilities↗2022-08-22

▶

Ubuntu

Libxslt vulnerabilities↗2022-08-22

▶

Red Hat

chromium-browser: Heap buffer overflow in Blink↗2019-04-23

▶

Debian

CVE-2019-5815: chromium - Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could...↗2019

▶

💬Community

Bugzilla

CVE-2019-5815 chromium-browser: Heap buffer overflow in Blink↗2019-04-25

▶

Bugzilla

CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-↗2019-04-25

▶

Bugzilla

▶