CVE-2019-13117

Aliases:DEBIAN-CVE-2019-13117ALPINE-CVE-2019-13117
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 01 Jul 2019, 01:27
Last modified:28 May 2026, 18:31

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
6.46% LOW
6% probability +2.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Jul 2019, 01:27
Published
Vulnerability first disclosed
28 May 2026, 18:31
Last Modified
Vulnerability information updated

Description

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 6.46%• Percentile: 93%

Techniques & Countermeasures

  • CWE-908•Use of Uninitialized Resource

    The product uses or accesses a resource that has not been initialized.

Affected Systems

  • alpine•libxslt

    < 1.1.33-r3 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.34-r0 | < 1.1.33-r3 | < 1.1.33-r3

  • canonical•ubuntu_linux

    12.04 | 14.04 | 16.04 | 18.04 | 19.04 | 19.10

  • debian•libxslt

    < 1.1.32-2.1 | < 1.1.32-2.1 | < 1.1.32-2.1 | < 1.1.32-2.1

  • debian•debian_linux

    8.0

  • fedoraproject•fedora

    31

  • opensuse•leap

    15.1

  • oracle•openjdk

    8:update231

  • xmlsoft•libxslt

    1.1.33

References (15)