Ubuntu has issued an advisory on October 22: https://usn.ubuntu.com/4164-1/ Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOO
As 'libxslt' maintainer, another one for you Shlomi.
Assignee: bugsquad => shlomif
CC: (none) => shlomifAssignee: shlomif => pkg-bugs
Patched package uploaded for cauldron and Mageia 7. Advisory: ======================== Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117). * In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118). * In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197). References: https://usn.ubuntu.com/4164-1/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197 ======================== Updated packages in core/updates_testing: ======================== lib64xslt1-1.1.33-2.1.mga7 lib64xslt-devel-1.1.33-2.1.mga7 python2-libxslt-1.1.33-2.1.mga7 xsltproc-1.1.33-2.1.mga7 from libxslt-1.1.33-2.1.mga7.src.rpm Test procedure https://wiki.mageia.org/en/QA_procedure:Libxslt and https://bugs.mageia.org/show_bug.cgi?id=24705#c9
CC: (none) => mramboWhiteboard: MGA7TOO => (none)Keywords: (none) => has_procedureVersion: Cauldron => 7Assignee: pkg-bugs => qa-bugs
MGA7-64 Plasma on Lenovo B50 No installation issues. Tested with chromium browser according procedure: all OK. Also tests with the cdcatalog.xsl, cdcatalog.xml and the libxml_xslt_transform_example.py are OK. $ xsltproc cdcatalog.xsl cdcatalog.xml <html><body> <h2>My CD Collection</h2> <table border="1"> <tr bgcolor="#9acd32"> <th>Title</th> <th>Artist</th> </tr> <tr> <td>Empire Burlesque</td> <td>Bob Dylan</td> </tr> </table> </body></html> $ python libxml_xslt_transform_example.py <html><body> <h2>My CD Collection</h2> <table border="1"> <tr bgcolor="#9acd32"> <th>Title</th> <th>Artist</th> </tr> <tr> <td>Empire Burlesque</td> <td>Bob Dylan</td> </tr> </table> </body></html>
CC: (none) => herman.viaeneWhiteboard: (none) => MGA7-64-OK
CC: (none) => tmb, sysadmin-bugsKeywords: (none) => advisory, validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0313.html
Status: NEW => RESOLVEDResolution: (none) => FIXED