Description
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285 ↗
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914 ↗
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768 ↗
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746 ↗
- https://usn.ubuntu.com/4164-1/ ↗
- https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html ↗
- https://security.netapp.com/advisory/ntap-20191031-0004/ ↗
- http://www.openwall.com/lists/oss-security/2019/11/17/2 ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html ↗
- https://access.redhat.com/errata/RHSA-2020:0514 ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html ↗
- https://www.oracle.com/security-alerts/cpuapr2020.html ↗
- https://security.netapp.com/advisory/ntap-20200416-0004/ ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html ↗