| Package | Affected versions | Patched versions |
|---|---|---|
| nokogiri | < 1.10.5 | 1.10.5 |
| icloud | ≥ 10.0, < 10.6< 7.13 | 10.67.13 |
| itunes | < 12.9.6 | 12.9.6 |
| e-series santricity os controller | ≥ 11.0, ≤ 11.50.2 | |
| jdk | = 1.8.0 | |
| libxslt | = 1.1.33 |
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free