Medium severity · published Jul 1, 2019
CVE-2019-13118
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to…
5.3
CVSS
5.1%
EPSS
No
On KEV
Description
In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
iOS · Apple
before 12.4 · source: NVD
MA
macOS · Apple
10.4.6 before 10.14.6 · source: NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
CD
Clustered Data Ontap · Netapp
All versions, or not specified · source: NVD
EP
E-series Performance Analyzer · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity Management Plug-ins · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity OS Controller · Netapp
11.0 through 11.50.2 · source: NVD
ES
E-series Santricity Storage Manager · Netapp
All versions, or not specified · source: NVD
ES
E-series Santricity Web Services · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
31 · source: NVD
IC
Icloud · Apple
before 7.13; 10.0 before 10.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13118
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
Mailing List
http://seclists.org/fulldisclosure/2019/Aug/11
Mailing List
http://seclists.org/fulldisclosure/2019/Aug/13
Mailing List
http://seclists.org/fulldisclosure/2019/Aug/14
Mailing List
http://seclists.org/fulldisclosure/2019/Aug/15
Mailing List
http://seclists.org/fulldisclosure/2019/Jul/22
More from iOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability
9.8
CVE-2025-31201
Apple Multiple Products Arbitrary Read and Write Vulnerability