In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
{
"unresolved_ranges": [
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8-update231"
}
],
"cpe": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "12.04"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "14.04"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "16.04"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "18.04"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "19.04"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "8.0"
}
],
"cpe": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
},
{
"source": "CPE_FIELD",
"extracted_events": [
{
"last_affected": "31"
}
],
"cpe": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
}
]
}{
"source": "CPE_FIELD",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "19.10"
}
],
"cpe": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
}{
"source": "CPE_FIELD",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "15.1"
}
],
"cpe": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
}{
"source": "CPE_FIELD",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.33"
}
],
"cpe": "cpe:2.3:a:xmlsoft:libxslt:1.1.33:*:*:*:*:*:*:*"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-13117.json"
[
{
"source": "https://gitlab.gnome.org/gnome/libxslt@c5eb6cf3aba0af048596106ed839b4ae17ecbcb1",
"id": "CVE-2019-13117-9ec108d4",
"digest": {
"length": 1909.0,
"function_hash": "149946325565218207761949792658421626761"
},
"target": {
"file": "libxslt/numbers.c",
"function": "xsltNumberFormatTokenize"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://gitlab.gnome.org/gnome/libxslt@c5eb6cf3aba0af048596106ed839b4ae17ecbcb1",
"id": "CVE-2019-13117-edce9c86",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43565303947768987112289376521803259580",
"19431884078099895786233513579532035761",
"49920840082758177635510753390799152839",
"72429694293929117164221740144272381935"
]
},
"target": {
"file": "libxslt/numbers.c"
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
}
]
"2026-05-13T08:41:45Z"