Alpine: multiple libxslt packages: security update to 1.1.33-r3

high Tenable Cloud Security Plugin ID 424137

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized
read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack
contains the characters A, a, I, i, or 0, or any other character. (CVE-2019-13117)

- In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too
narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to
a read of uninitialized stack data. (CVE-2019-13118)

- In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain
circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds
check could fail and memory outside a buffer could be written to, or uninitialized data could be
disclosed. (CVE-2019-18197)

Plugin Details

Severity: High

ID: 424137

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: Medium

Base Score: 5.1

Temporal Score: 3.8

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-18197

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/30/2019

Reference Information

CVE: CVE-2019-13117, CVE-2019-13118, CVE-2019-18197

BID: 109323

Detections

Analytics