Vulnerability DatabaseCVE-2019-18197
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2019-18197
Published:October 18, 2019
Updated:May 17, 2026
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
Affected Packages
nokogiri (RUBY):
Affected version(s) >=1.0.0 <1.10.5
Fix Suggestion:
Update to version 1.10.5
Related Resources (24)
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml
https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html
https://security.netapp.com/advisory/ntap-20191031-0004
https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934
https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
https://access.redhat.com/security/cve/CVE-2019-18197
https://usn.ubuntu.com/4164-1
https://security.netapp.com/advisory/ntap-20191031-0004/
http://www.openwall.com/lists/oss-security/2019/11/17/2
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914
https://nvd.nist.gov/vuln/detail/CVE-2019-18197
https://security.netapp.com/advisory/ntap-20200416-0004
https://security.netapp.com/advisory/ntap-20200416-0004/
https://github.com/sparklemotion/nokogiri/issues/1943
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768
https://www.oracle.com/security-alerts/cpuapr2020.html
https://github.com/sparklemotion/nokogiri
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
https://usn.ubuntu.com/4164-1/
https://access.redhat.com/errata/RHSA-2020:0514
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Use After Free
CWE-416
Use of Uninitialized Resource
CWE-908
EPSS
Base Score:
4.53