NVD脆弱性詳細

CVE-2019-13118

概要	In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
公表日	2019年7月1日11:15
登録日	2021年1月26日11:38
最終更新日	2024年11月21日13:24

CVSS3.1 : MEDIUM
スコア	5.3
ベクター	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:xmlsoft:libxslt:1.1.33:::::::*

構成2		以上	以下	より上	未満
cpe:2.3:o:opensuse:leap:15.1:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:netapp:cloud_backup:-:::::::*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*
cpe:2.3:a:netapp:oncommand_insight:-:::::::*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*
cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*
cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::	11.0	11.50.2
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
cpe:2.3:a:netapp:e-series_santricity_web_services:-:::::web_services_proxy::
cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:::::::*
cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:::::vmware_vcenter::
cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::*
cpe:2.3:a:netapp:santricity_unified_manager:-:::::::*
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:::::::*

構成4		以上	以下	より上	未満
cpe:2.3:a:oracle:jdk:1.8.0:update231::::::

構成5		以上	以下	より上	未満
cpe:2.3:o:fedoraproject:fedora:31:::::::*

構成6	以上	以下	より上	未満
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::

構成7	以上	以下	より上	未満
cpe:2.3:o:apple:tvos::::::::				12.4
cpe:2.3:o:apple:iphone_os::::::::				12.4
cpe:2.3:a:apple:icloud::::::windows::*				7.13
cpe:2.3:a:apple:itunes::::::windows::*				12.9.6
cpe:2.3:a:apple:icloud::::::windows::*	10.0			10.6
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003::::::
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001::::::
cpe:2.3:o:apple:macos::::::::	10.4.6			10.14.6
cpe:2.3:o:apple:mac_os_x:10.12.6:security_update_2019-001::::::
cpe:2.3:o:apple:mac_os_x:10.12.6:security_update_2019-002::::::
cpe:2.3:o:apple:mac_os_x:10.12.6:security_update_2019-003::::::
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002::::::

関連情報、対策とツール

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html	Mailing List Third Party Advisory
3	http://seclists.org/fulldisclosure/2019/Aug/11	Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2019/Aug/11	Mailing List Third Party Advisory
5	http://seclists.org/fulldisclosure/2019/Aug/13	Mailing List Third Party Advisory
6	http://seclists.org/fulldisclosure/2019/Aug/13	Mailing List Third Party Advisory
7	http://seclists.org/fulldisclosure/2019/Aug/14	Mailing List Third Party Advisory
8	http://seclists.org/fulldisclosure/2019/Aug/14	Mailing List Third Party Advisory
9	http://seclists.org/fulldisclosure/2019/Aug/15	Mailing List Third Party Advisory
10	http://seclists.org/fulldisclosure/2019/Aug/15	Mailing List Third Party Advisory
11	http://seclists.org/fulldisclosure/2019/Jul/22	Mailing List Third Party Advisory
12	http://seclists.org/fulldisclosure/2019/Jul/22	Mailing List Third Party Advisory
13	http://seclists.org/fulldisclosure/2019/Jul/23	Mailing List Third Party Advisory
14	http://seclists.org/fulldisclosure/2019/Jul/23	Mailing List Third Party Advisory
15	http://seclists.org/fulldisclosure/2019/Jul/24	Mailing List Third Party Advisory
16	http://seclists.org/fulldisclosure/2019/Jul/24	Mailing List Third Party Advisory
17	http://seclists.org/fulldisclosure/2019/Jul/26	Mailing List Third Party Advisory
18	http://seclists.org/fulldisclosure/2019/Jul/26	Mailing List Third Party Advisory
19	http://seclists.org/fulldisclosure/2019/Jul/31	Mailing List Third Party Advisory
20	http://seclists.org/fulldisclosure/2019/Jul/31	Mailing List Third Party Advisory
21	http://seclists.org/fulldisclosure/2019/Jul/37	Mailing List Third Party Advisory
22	http://seclists.org/fulldisclosure/2019/Jul/37	Mailing List Third Party Advisory
23	http://seclists.org/fulldisclosure/2019/Jul/38	Mailing List Third Party Advisory
24	http://seclists.org/fulldisclosure/2019/Jul/38	Mailing List Third Party Advisory
25	http://www.openwall.com/lists/oss-security/2019/11/17/2	Mailing List Third Party Advisory
26	http://www.openwall.com/lists/oss-security/2019/11/17/2	Mailing List Third Party Advisory
27	https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069	Permissions Required
28	https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069	Permissions Required
29	https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b	Patch Third Party Advisory
30	https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b	Patch Third Party Advisory
31	https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
32	https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
33	https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
34	https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
35	https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html	Mailing List Third Party Advisory
36	https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html	Mailing List Third Party Advisory
37	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
38	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
39	https://oss-fuzz.com/testcase-detail/5197371471822848	Permissions Required
40	https://oss-fuzz.com/testcase-detail/5197371471822848	Permissions Required
41	https://seclists.org/bugtraq/2019/Aug/21	Mailing List Third Party Advisory
42	https://seclists.org/bugtraq/2019/Aug/21	Mailing List Third Party Advisory
43	https://seclists.org/bugtraq/2019/Aug/22	Mailing List Third Party Advisory
44	https://seclists.org/bugtraq/2019/Aug/22	Mailing List Third Party Advisory
45	https://seclists.org/bugtraq/2019/Aug/23	Mailing List Third Party Advisory
46	https://seclists.org/bugtraq/2019/Aug/23	Mailing List Third Party Advisory
47	https://seclists.org/bugtraq/2019/Aug/25	Mailing List Third Party Advisory
48	https://seclists.org/bugtraq/2019/Aug/25	Mailing List Third Party Advisory
49	https://seclists.org/bugtraq/2019/Jul/35	Mailing List Third Party Advisory
50	https://seclists.org/bugtraq/2019/Jul/35	Mailing List Third Party Advisory
51	https://seclists.org/bugtraq/2019/Jul/36	Mailing List Third Party Advisory
52	https://seclists.org/bugtraq/2019/Jul/36	Mailing List Third Party Advisory
53	https://seclists.org/bugtraq/2019/Jul/37	Mailing List Third Party Advisory
54	https://seclists.org/bugtraq/2019/Jul/37	Mailing List Third Party Advisory
55	https://seclists.org/bugtraq/2019/Jul/40	Mailing List Third Party Advisory
56	https://seclists.org/bugtraq/2019/Jul/40	Mailing List Third Party Advisory
57	https://seclists.org/bugtraq/2019/Jul/41	Mailing List Third Party Advisory
58	https://seclists.org/bugtraq/2019/Jul/41	Mailing List Third Party Advisory
59	https://seclists.org/bugtraq/2019/Jul/42	Mailing List Third Party Advisory
60	https://seclists.org/bugtraq/2019/Jul/42	Mailing List Third Party Advisory
61	https://security.netapp.com/advisory/ntap-20190806-0004/	Third Party Advisory
62	https://security.netapp.com/advisory/ntap-20190806-0004/	Third Party Advisory
63	https://security.netapp.com/advisory/ntap-20200122-0003/	Third Party Advisory
64	https://security.netapp.com/advisory/ntap-20200122-0003/	Third Party Advisory
65	https://support.apple.com/kb/HT210346	Third Party Advisory
66	https://support.apple.com/kb/HT210346	Third Party Advisory
67	https://support.apple.com/kb/HT210348	Third Party Advisory
68	https://support.apple.com/kb/HT210348	Third Party Advisory
69	https://support.apple.com/kb/HT210351	Third Party Advisory
70	https://support.apple.com/kb/HT210351	Third Party Advisory
71	https://support.apple.com/kb/HT210353	Third Party Advisory
72	https://support.apple.com/kb/HT210353	Third Party Advisory
73	https://support.apple.com/kb/HT210356	Third Party Advisory
74	https://support.apple.com/kb/HT210356	Third Party Advisory
75	https://support.apple.com/kb/HT210357	Third Party Advisory
76	https://support.apple.com/kb/HT210357	Third Party Advisory
77	https://support.apple.com/kb/HT210358	Third Party Advisory
78	https://support.apple.com/kb/HT210358	Third Party Advisory
79	https://usn.ubuntu.com/4164-1/	Third Party Advisory
80	https://usn.ubuntu.com/4164-1/	Third Party Advisory
81	https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory
82	https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-843	型の取り違え	https://cwe.mitre.org/data/definitions/843.html

JVN脆弱性情報

libxslt における入力確認に関する脆弱性

タイトル	libxslt における入力確認に関する脆弱性
概要	libxslt には、入力確認に関する脆弱性が存在します。
想定される影響	情報を取得される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2019年6月3日0:00
登録日	2019年7月10日10:18
最終更新日	2020年6月1日14:05

影響を受けるシステム

日立

Hitachi Automation Director

Hitachi Compute Systems Manager

Hitachi Configuration Manager

Hitachi Device Manager

Hitachi Dynamic Link Manager

Hitachi Global Link Manager

Hitachi Infrastructure Analytics Advisor (海外販売のみ)

Hitachi Ops Center Analyzer (海外販売のみ)

Hitachi Ops Center Analyzer viewpoint (海外販売のみ)

Hitachi Ops Center API Configuration Manager

Hitachi Ops Center Automator

Hitachi Ops Center Common Services (海外販売のみ)

Hitachi Replication Manager

Hitachi Tiered Storage Manager

Hitachi Tuning Manager

xmlsoft.org

libxslt 1.1.33

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-13118	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118
National Vulnerability Database (NVD)
2	CVE-2019-13118	https://nvd.nist.gov/vuln/detail/CVE-2019-13118

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	名前	URL
GNOME GIT REPOSITORY
1	Fix uninitialized read with UTF-8 grouping chars	https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b
Hitachi Software Vulnerability Information
2	hitachi-sec-2020-103	https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2020-103/index.html
セキュリティ情報
3	hitachi-sec-2020-103	https://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2020-103/index.html

変更履歴

No	変更内容	変更日
1	[2019年07月10日] 掲載	2019年7月10日10:18
3	[2020年06月01日] 影響を受けるシステム：内容を更新ベンダ情報：Hitachi Software Vulnerability Information (hitachi-sec-2020-103) を追加ベンダ情報：ソフトウェア製品セキュリティ情報 (hitachi-sec-2020-103) を追加	2020年6月1日11:27

構成3	以上	以下	より上	未満
cpe:2.3:a:netapp:cloud_backup:-:::::::*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*
cpe:2.3:a:netapp:oncommand_insight:-:::::::*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:::::::*
cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*
cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::	11.0	11.50.2
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
cpe:2.3:a:netapp:e-series_santricity_web_services:-:::::web_services_proxy::
cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:::::::*
cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:::::vmware_vcenter::
cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::*
cpe:2.3:a:netapp:santricity_unified_manager:-:::::::*
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:::::::*

構成6	以上	以下	より上	未満
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::