CVE-2019-18197: canonical ubuntu_linux Use After Free
Vulnerability summary
CVE-2019-18197 is a high (CVSS 7.5) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 4.45% chance of exploitation in the next 30 days, higher than 91.4% of scored vulnerabilities.
Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 9Timeline
- 18-10-2019PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · RubygemsEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.45%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Increase +0.08 pp
From 4.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse17 products
- libxslt&distro=HPE Helion OpenStack 8< 1.1.28-17.9.1
- libxslt&distro=SUSE Enterprise Storage 5< 1.1.28-17.9.1
- libxslt&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 1.1.28-17.9.1
- libxslt&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 1.1.28-17.9.1
- libxslt&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 1.1.28-17.9.1
Debian2 products
- libxslt< 1.1.32-2.2 | < 1.1.28-2+deb8u6
- debian_linuxEOL8.0
Alpine1 product
- libxslt< 1.1.33-r2 | < 1.1.33-r3 | < 1.1.31-r2
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.04 | 19.10
RubyGems1 product
- nokogiri< 1.10.5
Ubuntu1 product
- libxslt< 1.1.28-2ubuntu0.2+esm1 | < 1.1.28-2.1ubuntu0.3 | < 1.1.29-5ubuntu0.2
Xmlsoft1 product
- libxslt1.1.33
7 vendors · 24 products
References
32 links- gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285X Refsource MISCWEBPatchThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746X Refsource MISCREPORTWEBIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2019/10/msg00037.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- www.openwall.com/lists/oss-security/2019/11/17/2Mailing ListX Refsource MLISTWEBThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.htmlVendor AdvisoryX Refsource SUSEWEB
Show all 32 references
- lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.htmlVendor AdvisoryX Refsource SUSEWEB
- security.netapp.com/advisory/ntap-20200416-0004/X Refsource CONFIRM
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlVendor AdvisoryX Refsource SUSEWEB
