01 Record

CVE-2019-13118

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal,

MediumPUBLISHEDCNA: mitre

CNA base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View raw JSON

02 Description

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal,

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

5.14% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 92.3% of scored records. A rank, not a probability.

NVD base score

5.3 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-07-01 01:27Z7 YR AGO

Last updated

2026-05-28 18:36Z5 MO AGO

Reserved

2019-06-30

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-843Access of Resource Using Incompatible Type ('Type Confusion')Base
CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferClass

Data version

5.2

Document digest

c67e70bbe05ce7cda4883172ba0eb3215af00dd0b22a00fe344bae9d582522c4

05 Affected products

VendorProductVersionsPlatforms

appleicloudNot specified—

appleiphone_osNot specified—

appleitunesNot specified—

applemac_os_xNot specified—

applemacosNot specified—

appletvosNot specified—

canonicalubuntu_linuxNot specified—

fedoraprojectfedoraNot specified—

netappactive_iq_unified_managerNot specified—

netappcloud_backupNot specified—

netappclustered_data_ontapNot specified—

netappe-series_performance_analyzerNot specified—

netappe-series_santricity_management_plug-insNot specified—

netappe-series_santricity_os_controllerNot specified—

netappe-series_santricity_storage_managerNot specified—

netappe-series_santricity_web_servicesNot specified—

netapponcommand_insightNot specified—

netapponcommand_workflow_automationNot specified—

netappontap_select_deploy_administration_utilityNot specified—

netappplug-in_for_symantec_netbackupNot specified—

netappsantricity_unified_managerNot specified—

netappsteelstore_cloud_integrated_storageNot specified—

opensuseleapNot specified—

oraclejdkNot specified—

redhatenterprise_linuxNot specified—

redhatopenstackNot specified—

redhatstorageNot specified—

xmlsoftlibxsltNot specified—

06 References

gitlab.gnome.orghttps://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71bx_refsource_MISC
oss-fuzz.comhttps://oss-fuzz.com/testcase-detail/5197371471822848x_refsource_MISC
bugs.chromium.orghttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069x_refsource_MISC
support.apple.comhttps://support.apple.com/kb/HT210348x_refsource_CONFIRM
support.apple.comhttps://support.apple.com/kb/HT210353x_refsource_CONFIRM
support.apple.comhttps://support.apple.com/kb/HT210351x_refsource_CONFIRM
lists.debian.org[debian-lts-announce] 20190722 [SECURITY] [DLA 1860-1] libxslt security updatehttps://lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlmailing-listx_refsource_MLIST
support.apple.comhttps://support.apple.com/kb/HT210346x_refsource_CONFIRM
seclists.org20190723 APPLE-SA-2019-7-22-1 iOS 12.4https://seclists.org/bugtraq/2019/Jul/35mailing-listx_refsource_BUGTRAQ
seclists.org20190723 APPLE-SA-2019-7-22-5 tvOS 12.4https://seclists.org/bugtraq/2019/Jul/37mailing-listx_refsource_BUGTRAQ
seclists.org20190723 APPLE-SA-2019-7-22-4 watchOS 5.3https://seclists.org/bugtraq/2019/Jul/36mailing-listx_refsource_BUGTRAQ
seclists.org20190723 APPLE-SA-2019-7-22-4 watchOS 5.3http://seclists.org/fulldisclosure/2019/Jul/24mailing-listx_refsource_FULLDISC
seclists.org20190723 APPLE-SA-2019-7-22-1 iOS 12.4http://seclists.org/fulldisclosure/2019/Jul/23mailing-listx_refsource_FULLDISC
seclists.org20190723 APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierrahttp://seclists.org/fulldisclosure/2019/Jul/22mailing-listx_refsource_FULLDISC
seclists.org20190723 APPLE-SA-2019-7-22-5 tvOS 12.4http://seclists.org/fulldisclosure/2019/Jul/26mailing-listx_refsource_FULLDISC
support.apple.comhttps://support.apple.com/kb/HT210356x_refsource_CONFIRM
support.apple.comhttps://support.apple.com/kb/HT210357x_refsource_CONFIRM
support.apple.comhttps://support.apple.com/kb/HT210358x_refsource_CONFIRM
seclists.org20190724 APPLE-SA-2019-7-23-2 iTunes for Windows 12.9.6https://seclists.org/bugtraq/2019/Jul/42mailing-listx_refsource_BUGTRAQ
seclists.org20190724 APPLE-SA-2019-7-23-3 iCloud for Windows 10.6https://seclists.org/bugtraq/2019/Jul/40mailing-listx_refsource_BUGTRAQ
seclists.org20190724 APPLE-SA-2019-7-23-1 iCloud for Windows 7.13https://seclists.org/bugtraq/2019/Jul/41mailing-listx_refsource_BUGTRAQ
seclists.org20190726 APPLE-SA-2019-7-23-3 iCloud for Windows 10.6http://seclists.org/fulldisclosure/2019/Jul/31mailing-listx_refsource_FULLDISC
seclists.org20190726 APPLE-SA-2019-7-23-1 iCloud for Windows 7.13http://seclists.org/fulldisclosure/2019/Jul/37mailing-listx_refsource_FULLDISC
seclists.org20190726 APPLE-SA-2019-7-23-2 iTunes for Windows 12.9.6http://seclists.org/fulldisclosure/2019/Jul/38mailing-listx_refsource_FULLDISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190806-0004/x_refsource_CONFIRM
seclists.org20190814 APPLE-SA-2019-8-13-2 Additional information for APPLE-SA-2019-7-22-1 iOS 12.4https://seclists.org/bugtraq/2019/Aug/25mailing-listx_refsource_BUGTRAQ
seclists.org20190814 APPLE-SA-2019-8-13-3 Additional information for APPLE-SA-2019-7-22-4 watchOS 5.3https://seclists.org/bugtraq/2019/Aug/22mailing-listx_refsource_BUGTRAQ
seclists.org20190814 APPLE-SA-2019-8-13-4 Additional information for APPLE-SA-2019-7-22-5 tvOS 12.4https://seclists.org/bugtraq/2019/Aug/23mailing-listx_refsource_BUGTRAQ
seclists.org20190814 APPLE-SA-2019-8-13-1 Additional information for APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierrahttps://seclists.org/bugtraq/2019/Aug/21mailing-listx_refsource_BUGTRAQ
seclists.org20190816 APPLE-SA-2019-8-13-3 Additional information for APPLE-SA-2019-7-22-4 watchOS 5.3http://seclists.org/fulldisclosure/2019/Aug/14mailing-listx_refsource_FULLDISC
seclists.org20190816 APPLE-SA-2019-8-13-1 Additional information for APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierrahttp://seclists.org/fulldisclosure/2019/Aug/11mailing-listx_refsource_FULLDISC
seclists.org20190816 APPLE-SA-2019-8-13-2 Additional information for APPLE-SA-2019-7-22-1 iOS 12.4http://seclists.org/fulldisclosure/2019/Aug/13mailing-listx_refsource_FULLDISC
seclists.org20190816 APPLE-SA-2019-8-13-4 Additional information for APPLE-SA-2019-7-22-5 tvOS 12.4http://seclists.org/fulldisclosure/2019/Aug/15mailing-listx_refsource_FULLDISC
usn.ubuntu.comUSN-4164-1https://usn.ubuntu.com/4164-1/vendor-advisoryx_refsource_UBUNTU
lists.fedoraproject.orgFEDORA-2019-fdf6ec39b4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/vendor-advisoryx_refsource_FEDORA
www.openwall.com[oss-security] 20191117 Nokogiri security update v1.10.5http://www.openwall.com/lists/oss-security/2019/11/17/2mailing-listx_refsource_MLIST
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
security.netapp.comhttps://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
lists.opensuse.orgopenSUSE-SU-2020:0731http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlvendor-advisoryx_refsource_SUSE
lists.apache.org[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Emailing-listx_refsource_MLIST

07 Fixed in

Debian 12

libxslt
Fixed in 1.1.32-2.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

libxslt
Fixed in 1.1.32-2.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

libxslt
Fixed in 1.1.32-2.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

libxslt
Fixed in 1.1.28-2.1ubuntu0.3

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

libxslt
Fixed in 1.1.29-5ubuntu0.2

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

libxslt
Fixed in 1.1.28-2ubuntu0.2+esm1
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.