In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under…
Priority MEDIUM 42CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 14 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.
Summary
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04446 91st percentileScored 2026-11-07
Fix Partial nokogiri (RubyGems): 1.10.5Red Hat: 3 advisoriesRed Hat: 14 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nokogiri (RubyGems) | before 1.10.5 | 1.10.5 | Patch available | GHSA-242x-7cm6-4w8j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nokogiri (RubyGems) Vendor— Affected before 1.10.5 Fixed in 1.10.5 Patch available GHSA-242x-7cm6-4w8j
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xmlsoft:libxslt:1.1.33:*:*:*:*:*:*:* | 1.1.33 | Vulnerable | xmlsoft |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
- cpe:2.3:a:xmlsoft:libxslt:1.1.33:*:*:*:*:*:*:* Versions 1.1.33 Vulnerable ·xmlsoft
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-242x-7cm6-4w8j nokogiri (RubyGems) Fixed in 1.10.5 Advisory →
Red Hat 3 advisories
- RHSA-2020:4464 Released 2020-11-04 · Red Hat rating Moderatelibxslt security update
- Red Hat Enterprise Linux AppStream (v. 8) libxslt-devel-1.1.32-5.el8
- Red Hat Enterprise Linux BaseOS (v. 8) libxslt-1.1.32-5.el8
- RHSA-2020:4005 Released 2020-09-29 · Red Hat rating Moderatelibxslt security update
- Red Hat Enterprise Linux Client (v. 7) libxslt-1.1.28-6.el7
- Red Hat Enterprise Linux Client Optional (v. 7) libxslt-devel-1.1.28-6.el7, libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) libxslt-1.1.28-6.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libxslt-devel-1.1.28-6.el7, libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux Server (v. 7) libxslt-1.1.28-6.el7, libxslt-1.1.28-6.el7.ppc, libxslt-devel-1.1.28-6.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) libxslt-python-1.1.28-6.el7
- Red Hat Enterprise Linux Workstation (v. 7) libxslt-1.1.28-6.el7, libxslt-devel-1.1.28-6.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) libxslt-python-1.1.28-6.el7
- RHSA-2020:0514 Released 2020-02-17 · Red Hat rating Importantchromium-browser security update
- Red Hat Enterprise Linux Desktop Supplementary (v. 6) chromium-browser-80.0.3987.87-1.el6_10
- Red Hat Enterprise Linux HPC Node Supplementary (v. 6) chromium-browser-80.0.3987.87-1.el6_10
- Red Hat Enterprise Linux Server Supplementary (v. 6) chromium-browser-80.0.3987.87-1.el6_10
- Red Hat Enterprise Linux Workstation Supplementary (v. 6) chromium-browser-80.0.3987.87-1.el6_10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4464 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4464 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Desktop Supplementary (v. 6) | Fixed | RHSA-2020:0514 |
| Red Hat Enterprise Linux HPC Node Supplementary (v. 6) | Fixed | RHSA-2020:0514 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Server Supplementary (v. 6) | Fixed | RHSA-2020:0514 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4005 |
| Red Hat Enterprise Linux Workstation Supplementary (v. 6) | Fixed | RHSA-2020:0514 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18197
- 2026-10-03 Alias added: GHSA-242x-7cm6-4w8j
References
Advisory 13
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746
- USN-4164-1
- [debian-lts-announce] 20191027 [SECURITY] [DLA 1973-1] libxslt security update
- https://security.netapp.com/advisory/ntap-20191031-0004/
- [oss-security] 20191117 Nokogiri security update v1.10.5
- openSUSE-SU-2020:0189
- openSUSE-SU-2020:0210
- RHSA-2020:0514
- openSUSE-SU-2020:0233
- openSUSE-SU-2020:0731
- https://nvd.nist.gov/vuln/detail/CVE-2019-18197
Other 9
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://security.netapp.com/advisory/ntap-20200416-0004/
- https://github.com/sparklemotion/nokogiri/issues/1943
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml
- https://github.com/sparklemotion/nokogiri
- https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934
- https://security.netapp.com/advisory/ntap-20191031-0004
- https://security.netapp.com/advisory/ntap-20200416-0004
- https://usn.ubuntu.com/4164-1
Sources
- CVE-2019-18197 · CVE Program
- CVE-2019-18197 · NVD
- FIRST EPSS
- GHSA-242x-7cm6-4w8j · GitHub Advisory Database · CC BY 4.0
- CVE-2019-18197 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences