CVE-2019-13118

A vulnerability was found in libxslt within the numbers.c file, where a type holding grouping characters of an xsl:number instruction was too narrow, this flaw allowed an invalid character/length combination to be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. This could result in undefined behavior or potential information disclosure.

• This issue affects the version of libxslt as shipped with Red Hat Gluster Storage 3, as it includes the affected code which allows uninitialized read.
• This issue affects the versions of libxslt as shipped with Red Hat Enterprise Linux 5, 6, 7 and 8. Red Hat Product Security has rated this issue as having a security impact of Low.
• Red Hat OpenStack Platform versions 9, 10, 13, & 14 are marked WONTFIX as they will inherit fixes from the underlying RHEL layer.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.