Launch Week Day 1: Announcing Security Design Review
MEDIUM 5.3 RubyGems

Uninitialized read in Nokogiri gem

GHSA-4hm9-844j-jmxp · CVE-2019-13117

Published · Modified

Description

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.

References

Ready to move

Start Securing

Free, no credit card | First findings in minutes