CVE-2019-13117: canonical ubuntu_linux Use of Uninitialized Resource
Vulnerability summary
CVE-2019-13117 is a medium (CVSS 5.3) Use of Uninitialized Resource vulnerability in canonical ubuntu_linux. EPSS estimates a 6.46% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 8Timeline
- 01-07-2019PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
CVSS metrics
8 scores · 6 sources · 3 versions- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · RubygemsEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
6.46%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.46% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- libxslt< 1.1.32-2.1
- debian_linuxEOL8.0
Alpine1 product
- libxslt< 1.1.33-r3 | < 1.1.34-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04 | 19.10
Fedoraproject1 product
- fedoraEOL31
Opensuse1 product
- leapEOL15.1
Oracle1 product
- openjdk8:update231
RubyGems1 product
- nokogiri< 1.10.5
Ubuntu1 product
- libxslt< 1.1.28-2ubuntu0.2+esm1 | < 1.1.28-2.1ubuntu0.3 | < 1.1.29-5ubuntu0.2
Xmlsoft1 product
- libxslt1.1.33
9 vendors · 10 products
References
28 links- gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1X Refsource MISCPatchThird Party AdvisoryWEB
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471X Refsource MISCIssue TrackingMailing ListThird Party AdvisoryWEB
lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB- www.openwall.com/lists/oss-security/2019/11/17/2Mailing ListX Refsource MLISTThird Party AdvisoryWEB
Show all 28 references
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
