VYPR
← All advisories
High severityNVD Advisory· Published Jul 1, 2019· Updated Aug 4, 2024

CVE-2019-13117

CVE-2019-13117

Description

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2019-13117: Uninitialized read in libxslt's xsl:number processing can leak stack bytes, enabling information disclosure.

CVE-2019-13117 is an information disclosure vulnerability in libxslt versions up to 1.1.33, specifically in the xsltNumberFormatInsertNumbers function within numbers.c. The issue arises when processing xsl:number with certain format strings, which can trigger an uninitialized read of stack memory [1][3]. This allows an attacker to infer whether stack bytes contain specific characters like 'A', 'a', 'I', 'i', or '0' by observing the output.

To exploit this, the attacker must provide a malicious XSLT stylesheet with a crafted xsl:number format string. No authentication is required if the victim processes the stylesheet. The attack surface includes applications that parse XSLT from untrusted sources, such as web browsers, document converters, or XML processing libraries like Nokogiri [2].

Successful exploitation leads to information disclosure, revealing partial contents of the stack memory. While this does not directly lead to arbitrary code execution, it can leak sensitive data or aid in bypassing memory protections like ASLR [3].

The vulnerability was fixed in libxslt 1.1.34. Ubuntu received patches in USN-4164-1, and Nokogiri v1.10.5 included the fix [2][3]. Users are advised to update their libxslt installations or use patched versions of dependent libraries.

References
  1. NVD - CVE-2019-13117
  2. security - Nokogiri security update v1.10.5
  3. USN-4164-1: Libxslt vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.10.51.10.5

Affected products

328

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

23

News mentions

0

No linked articles in our index yet.