UbuntuUpdates.org

Package "libxslt"

Name: libxslt

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • XSLT 1.0 processing library - debugging symbols
  • XSLT 1.0 processing library - development kit
  • XSLT 1.0 processing library - runtime library
  • Python bindings for libxslt1
Latest version: 1.1.29-5ubuntu0.3
Release: bionic (18.04)
Level: security
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libxslt" in Bionic

Repository Area Version
base main 1.1.29-5
updates main 1.1.29-5ubuntu0.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.1.29-5ubuntu0.3 2022-08-22 15:07:03 UTC

  libxslt (1.1.29-5ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Potential heap corruption
    - debian/patches/CVE-2019-5815.patch: always set
      context mode before calling XPath iterators in
      libxslt/numbers.c, test/docs/bug-218.xml,
      tests/general/bug-128.out, tests/geral/bug-218.xsl.
    - CVE-2019-5815
  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2021-30560.patch: fix use after free
      in xsltApplyTemplates in libxslt/transform.c.
    - CVE-2021-30560

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 18 Aug 2022 10:04:19 -0300
Source diff to previous version
CVE-2019-5815 Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted X
CVE-2021-30560 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted H

Version: 1.1.29-5ubuntu0.2 2019-10-22 18:07:11 UTC

  libxslt (1.1.29-5ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Uninitialized read
    - debian/patches/CVE-2019-13117.patch: Fix uninitialized
      read of xsl:number token in libxslt/numbers.c.
    - CVE-2019-13117
  * SECURITY UPDATE: Uninitialized read
    - debian/patches/CVE-2019-13118.patch: Fix uninitialized
      read with UTF-8 grouping chars in libxslt/numbers.c,
      tests/docs/bug-222.xml, tests/general/bug-222.out,
      tests/general/bug-222.xsl.
    - CVE-2019-13118
  * SECURITY UPDATE: Buffer over-read
    - debian/patches/CVE-2019-18197.patch: Fix dangling
      pointer in xsltCopyText in libxslt/transform.c.
    - CVE-2019-18197

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 22 Oct 2019 09:52:39 -0300
Source diff to previous version
CVE-2019-13117 In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This c
CVE-2019-13118 In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combin
CVE-2019-18197 In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to

Version: 1.1.29-5ubuntu0.1 2019-04-15 19:07:13 UTC

  libxslt (1.1.29-5ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Bypass of protection mechanism
    - debian/patches/CVE-2019-11068.patch: Fix security
      framework bypass checking for returns equal or less
      -1 in libxslt/documents.c, libxslt/imports.c,
      libxslt/transform.c,libxslt/xslt.c.
    - CVE-2019-11068

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 12 Apr 2019 13:56:36 -0300
CVE-2019-11068 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving


About   -   Send Feedback to @ubuntu_updates