VYPR
← All advisories
High severityNVD Advisory· Published Oct 18, 2019· Updated Aug 5, 2024

CVE-2019-18197

CVE-2019-18197

Description

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In libxslt 1.1.33, a pointer variable in xsltCopyText is not reset, leading to a use-after-free that can cause out-of-bounds write or information disclosure.

The vulnerability resides in the xsltCopyText function within transform.c of libxslt 1.1.33. A pointer variable is not properly reset under certain conditions, which can lead to a use-after-free scenario if the freed memory is later reused. This flaw can cause a bounds check to fail, resulting in writes outside allocated buffers or the disclosure of uninitialized memory [2].

An attacker could exploit this by providing a specially crafted XSLT stylesheet or XML document that triggers the vulnerable code path. The exploitation requires that the freed memory be reused in a specific manner, which may increase complexity but remains feasible [2].

Successful exploitation could allow an attacker to corrupt memory, potentially leading to arbitrary code execution or the leakage of sensitive information from uninitialized memory [2].

The issue is fixed in libxslt 1.1.34. Red Hat has released RHSA-2020:0514 to address the vulnerability in affected Red Hat Enterprise Linux versions [1]. Additionally, the Nokogiri Ruby gem, which bundles libxslt, released version 1.10.5 to mitigate this CVE [4]. Users are advised to update to patched versions.

References
  1. https://access.redhat.com/errata/RHSA-2020:0514
  2. NVD - CVE-2019-18197
  3. security - Nokogiri security update v1.10.5

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.10.51.10.5

Affected products

30

Patches

1
2232473733b7
https://gitlab.gnome.org/GNOME/libxsltvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

23

News mentions

0

No linked articles in our index yet.