CVE-2019-5815

Vulnerability

Description

CVE-2019-5815 is a type confusion vulnerability in the xsltNumberFormatGetMultipleLevel function of libxslt prior to version 1.1.33. This bug allows an attacker to potentially trigger heap corruption by providing specially crafted XML data to an application that performs XSLT transformations using the vulnerable library [1][2]. Type confusion occurs when a program accesses a resource using an incompatible type, leading to memory corruption and potentially arbitrary code execution.

Attack

Vector

The vulnerability is triggered when libxslt processes a maliciously crafted XML document during XSLT number formatting. No authentication is required, as the attack surface is through parsing untrusted XML input. Applications that use libxslt to transform user-supplied XML are at risk, including the popular Ruby library Nokogiri, which vendors libxslt for XML and XSLT processing [1][3].

Impact

Successful exploitation of this heap corruption issue could allow an attacker to crash the application or execute arbitrary code in the context of the process. The severity is elevated because libxslt is widely used in web applications and services that handle untrusted XML, potentially leading to remote code execution [2].

Mitigation

The fix was released in libxslt version 1.1.34, which was then vendored into Nokogiri starting from version 1.10.5. Users are advised to upgrade Nokogiri to at least version 1.10.5 or libxslt to 1.1.34 or later. For users of packages that bundle libxslt (e.g., Nokogiri), updating to the latest patched version is the recommended mitigation [4]. The vulnerability was also addressed in Ubuntu's libxslt package via USN-5575-1 [4].