Debian Bug report logs -
#926895
libxslt: CVE-2019-11068
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>:
Bug#926895; Package src:libxslt.
(Thu, 11 Apr 2019 20:48:07 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>.
(Thu, 11 Apr 2019 20:48:07 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: libxslt
Version: 1.1.32-2
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libxslt/issues/12
Hi,
The following vulnerability was published for libxslt.
CVE-2019-11068[0]:
| libxslt through 1.1.33 allows bypass of a protection mechanism because
| callers of xsltCheckRead and xsltCheckWrite permit access even upon
| receiving a -1 error code. xsltCheckRead can return -1 for a crafted
| URL that is not actually invalid and is subsequently loaded.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-11068
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068
[1] https://gitlab.gnome.org/GNOME/libxslt/issues/12
[2] https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>:
Bug#926895; Package src:libxslt.
(Sun, 21 Apr 2019 20:06:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>.
(Sun, 21 Apr 2019 20:06:02 GMT) (full text, mbox, link).
Message #10 received at 926895@bugs.debian.org (full text, mbox, reply):
On Thu, Apr 11, 2019 at 10:46:05PM +0200, Salvatore Bonaccorso wrote:
> Source: libxslt
> Version: 1.1.32-2
> Severity: important
> Tags: security upstream
> Forwarded: https://gitlab.gnome.org/GNOME/libxslt/issues/12
>
> Hi,
>
> The following vulnerability was published for libxslt.
>
> CVE-2019-11068[0]:
> | libxslt through 1.1.33 allows bypass of a protection mechanism because
> | callers of xsltCheckRead and xsltCheckWrite permit access even upon
> | receiving a -1 error code. xsltCheckRead can return -1 for a crafted
> | URL that is not actually invalid and is subsequently loaded.
I submitted an MR at salsa.
Cheers,
Moritz
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 13:40:51 2019;
Machine Name:
beach
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon