Bug 25643 - libxslt new security issues CVE-2019-1311[78] and CVE-2019-18197
Summary: libxslt new security issues CVE-2019-1311[78] and CVE-2019-18197
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2019-10-31 05:08 CET by David Walser
Modified: 2019-11-02 17:56 CET (History)
5 users (show)

See Also:
Source RPM: libxslt-1.1.33-2.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-10-31 05:08:17 CET
Ubuntu has issued an advisory on October 22:
https://usn.ubuntu.com/4164-1/

Mageia 7 is also affected.
David Walser 2019-10-31 05:08:25 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Lewis Smith 2019-10-31 09:53:46 CET
As 'libxslt' maintainer, another one for you Shlomi.

Assignee: bugsquad => shlomif

David Walser 2019-10-31 13:00:48 CET

CC: (none) => shlomif
Assignee: shlomif => pkg-bugs

Comment 2 Mike Rambo 2019-11-01 18:39:43 CET
Patched package uploaded for cauldron and Mageia 7.

Advisory:
========================

Updated libxslt package fixes security vulnerabilities:

* In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117).
* In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118).
* In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197).


References:
https://usn.ubuntu.com/4164-1/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197
========================

Updated packages in core/updates_testing:
========================
lib64xslt1-1.1.33-2.1.mga7
lib64xslt-devel-1.1.33-2.1.mga7
python2-libxslt-1.1.33-2.1.mga7
xsltproc-1.1.33-2.1.mga7

from libxslt-1.1.33-2.1.mga7.src.rpm


Test procedure https://wiki.mageia.org/en/QA_procedure:Libxslt and https://bugs.mageia.org/show_bug.cgi?id=24705#c9

CC: (none) => mrambo
Whiteboard: MGA7TOO => (none)
Keywords: (none) => has_procedure
Version: Cauldron => 7
Assignee: pkg-bugs => qa-bugs

Comment 3 Herman Viaene 2019-11-02 14:27:19 CET
MGA7-64 Plasma on Lenovo B50
No installation issues.
Tested with chromium browser according procedure: all OK.
Also tests with the cdcatalog.xsl, cdcatalog.xml and the libxml_xslt_transform_example.py are OK.

$ xsltproc cdcatalog.xsl cdcatalog.xml
<html><body>
<h2>My CD Collection</h2>
<table border="1">
<tr bgcolor="#9acd32">
<th>Title</th>
<th>Artist</th>
</tr>
<tr>
<td>Empire Burlesque</td>
<td>Bob Dylan</td>
</tr>
</table>
</body></html>

$ python libxml_xslt_transform_example.py
<html><body>
<h2>My CD Collection</h2>
<table border="1">
<tr bgcolor="#9acd32">
<th>Title</th>
<th>Artist</th>
</tr>
<tr>
<td>Empire Burlesque</td>
<td>Bob Dylan</td>
</tr>
</table>
</body></html>

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Thomas Backlund 2019-11-02 16:56:04 CET

CC: (none) => tmb, sysadmin-bugs
Keywords: (none) => advisory, validated_update

Comment 4 Mageia Robot 2019-11-02 17:56:18 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0313.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.