CVE-2019-11068
- State
- Published
- Severity
- 9.8 Critical
- Published
- Apr 10, 2019
- Updated
- May 28, 2026
- Reserved
- Apr 10, 2019
Description
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
- [debian-lts-announce] 20190415 [SECURITY] [DLA 1756-1] libxslt security updatemailing-list
- USN-3947-2vendor-advisory
- [oss-security] 20190422 Nokogiri security update v1.10.3mailing-list
- USN-3947-1vendor-advisory
- [oss-security] 20190423 Re: Nokogiri security update v1.10.3mailing-list
- openSUSE-SU-2019:1433vendor-advisory
- openSUSE-SU-2019:1430vendor-advisory
- openSUSE-SU-2019:1428vendor-advisory
- openSUSE-SU-2019:1527vendor-advisory
- FEDORA-2019-e21c77ffaevendor-advisory
- FEDORA-2019-320d5295fcvendor-advisory
- FEDORA-2019-e74d639587vendor-advisory
- openSUSE-SU-2019:1824vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://security.netapp.com/advisory/ntap-20191017-0001/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.