CVE-2019-13117

What it actually does

Uninitialized read in xsltNumberFormatInsertNumbers triggered by crafted xsl:number format strings allows an attacker to determine whether a specific stack byte holds one of the characters A, a, I, i, 0 or any other value.

Why it matters to the business

Attackers may obtain limited sensitive information from application memory, increasing the risk of further attacks such as bypassing address-space protections or inferring internal data structures; the issue affects any software that processes untrusted XSLT stylesheets with libxslt.

How an attack unfolds

An attacker crafts a malicious XSLT stylesheet containing an xsl:number element with a specially chosen format string, supplies it to an application that invokes libxslt on attacker-controlled or influenced input, and inspects the resulting output to learn the contents of chosen stack bytes.

How to fix it

Upgrade libxslt to the version containing commit c5eb6cf3aba0af048596106ed839b4ae17ecbcb1 or later; rebuild and redeploy all dependent applications after the library update.

How to confirm the fix worked

Confirm the installed libxslt shared library or package reports a version newer than the vulnerable 1.1.33 release and contains the referenced commit hash; run regression tests that exercise xsl:number formatting with the previously problematic format strings and verify no uninitialized data is leaked.

Typical attack path

1. Identify an application or service that accepts or processes XSLT stylesheets using libxslt
2. Craft an xsl:number element with a format string that triggers the uninitialized read path
3. Submit the stylesheet along with any required XML input to the target
4. Observe the generated output or side-channel behavior to infer the value of targeted stack bytes
5. Repeat or chain observations to map additional memory contents

How to detect it

Review application logs for XSLT transformation requests that produce unexpected numeric or alphabetic output patterns; correlate with inbound stylesheet uploads or external XSLT references and inspect for repeated or systematic probing of format-string behavior.

What your security team should do

• Immediately inventory all systems and containers that link against libxslt and schedule upgrades to the fixed commit
• Block or sanitize untrusted XSLT stylesheets at application entry points until patches are applied
• Update vulnerability scanners and dependency manifests to flag the affected libxslt versions
• Review logging configurations to capture XSLT processing errors or unusual output patterns for post-patch monitoring