CVE-2019-13118

Name of the Vulnerable Software and Affected Versions libxslt version 1.1.33 Nokogiri versions prior to 1.10.5

Description The issue arises from insufficient input validation in the xsltNumberFormatDecimal function of the libxslt library. This could allow a remote attacker to gain unauthorized access to protected information. The problem is caused by a type holding grouping characters of an xsl:number instruction being too narrow, leading to an invalid character/length combination being passed to xsltNumberFormatDecimal, and resulting in a read of uninitialized stack data.

Recommendations For libxslt version 1.1.33, update to version 1.1.34 or later to address this issue. For Nokogiri versions prior to 1.10.5, update to version 1.10.5 or later, which includes an updated version of libxslt that addresses this vulnerability.