CVE-2019-11068

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

A dependency of Nokogiri, libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

• CVE-2019-11068: fix security framework bypass in xsltCheckRead and xsltCheckWrite callers
• CVE-2019-18197: fix dangling pointer in xsltCopyText
• CVE-2019-5815: always set context node before calling XPath iterators
• CVE-2021-30560: fix use-after-free in xsltApplyTemplates
• CVE-2024-55549: fix use-after-free related to excluded namespaces
• CVE-2025-24855: fix use-after-free of XPath context node in nested XPath evaluations

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded (CVE-2019-11068).

This update for libxslt fixes the following issues:

Security issue fixed:

• CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libxslt fixes the following issues:

Security issue fixed:

• CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160).

This update was imported from the SUSE:SLE-15:Update update project.

This update for rmt-server to version 2.1.4 fixes the following issues:

• Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222)
• Mirror additional repos that were enabled during mirroring (bsc#1132690)
• Make service IDs consistent across different RMT instances (bsc#1134428)
• Make SMT data import scripts faster (bsc#1134190)
• Fix incorrect triggering of registration sharing (bsc#1129392)
• Fix license mirroring issue in some non-SUSE repositories (bsc#1128858)
• Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806)
• Truncate the RMT lockfile when writing a new PID (bsc#1125770)
• Fix missing trailing slashes on custom repository import from SMT (bsc#1118745)
• Zypper authentication plugin (fate#326629)
• Instance verification plugin in rmt-server-pubcloud (fate#326629)
• Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160)
• Allow RMT registration to work under HTTP as well as HTTPS.
• Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module
• Online migrations will automatically add additional modules to the client systems depending on the base product
• Supply log severity to journald
• Breaking Change: Added headers to generated CSV files

This update was imported from the SUSE:SLE-15:Update update project.

This update for rmt-server to version 2.3.1 fixes the following issues:

• Fix mirroring logic when errors are encountered (bsc#1140492)
• Refactor RMT::Mirror to download metadata/licenses in parallel
• Check repo metadata GPG signatures during mirroring (bsc#1132690)
• Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081)
• Fix dependency to removed boot_cli_i18n file (bsc#1136020)
• Add rmt-cli systems list command to list registered systems
• Fix create UUID when system_uuid file empty (bsc#1138316)
• Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222)
• Mirror additional repos that were enabled during mirroring (bsc#1132690)
• Make service IDs consistent across different RMT instances (bsc#1134428)
• Make SMT data import scripts faster (bsc#1134190)
• Fix incorrect triggering of registration sharing (bsc#1129392)
• Fix license mirroring issue in some non-SUSE repositories (bsc#1128858)
• Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160)
• Allow RMT registration to work under HTTP as well as HTTPS.
• Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module
• Online migrations will automatically add additional modules to the client systems depending on the base product
• Supply log severity to journald
• Breaking Change: Added headers to generated CSV files

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the rmt-server-2.6.13-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libxslt-devel-1.1.34-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby2.7-rubygem-nokogiri-1.12.3-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.1-rubygem-nokogiri-1.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.2-rubygem-nokogiri-1.13.9-1.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.3-rubygem-nokogiri-1.15.5-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby3.4-rubygem-nokogiri-1.18.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-nokogiri-1.18.9-1.4 package on the GA media of openSUSE Tumbleweed.

This update for libxslt fixes the following issues:

Security issue fixed:

• CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160).

This update for libxslt fixes the following issues:

Security issue fixed:

• CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160).

This update for libxslt fixes the following issues:

• CVE-2019-11068: Fixed a protection mechanism bypass where callers of xsltCheckRead() and xsltCheckWrite() would permit access upon receiving an error (bsc#1132160).

This update for rmt-server to version 2.1.4 fixes the following issues:

• Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222)
• Mirror additional repos that were enabled during mirroring (bsc#1132690)
• Make service IDs consistent across different RMT instances (bsc#1134428)
• Make SMT data import scripts faster (bsc#1134190)
• Fix incorrect triggering of registration sharing (bsc#1129392)
• Fix license mirroring issue in some non-SUSE repositories (bsc#1128858)
• Set CURLOPT_LOW_SPEED_LIMIT to prevent downloads from getting stuck (bsc#1107806)
• Truncate the RMT lockfile when writing a new PID (bsc#1125770)
• Fix missing trailing slashes on custom repository import from SMT (bsc#1118745)
• Zypper authentication plugin (fate#326629)
• Instance verification plugin in rmt-server-pubcloud (fate#326629)
• Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160)
• Allow RMT registration to work under HTTP as well as HTTPS.
• Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module
• Online migrations will automatically add additional modules to the client systems depending on the base product
• Supply log severity to journald
• Breaking Change: Added headers to generated CSV files

This update for ardana and crowbar fixes the following issues:

• Restrict rootwrap directories for cinder (bsc#1132542)
• Change Cinder default log level from DEBUG to INFO (SCRD-7132)
• Remove configuration from migration (bsc#1126391)
• Configurable innodb flush options (SCRD-7496)
• Secure designate's rootwrap files (bsc#1132542)
• specify rootwrap config file in designate sudoer (bsc#1132542)
• Update Designate log threshold from DEBUG to INFO (SCRD-8459)
• Change Glance default log level from DEBUG to INFO (SCRD-8592)
• Change Heat default log level from DEBUG to INFO (SCRD-7132)
• Fix Horizon missing create snapshot action for users (bsc#1130593)
• Don't set external-name in ardana-ci models (SCRD-7471)
• Fix fail-over/-back behavior of haproxy for galera (bsc#1122875)
• Update swift endpoints from keystone-reconfigure.yml if needed (SCRD-8703)
• Change Magnum default log level from DEFAULT to INFO (SCRD-7132)
• Rip out vertica related code (SCRD-9031)
• Tighten neutron sudoers to only execute rootwrap (bsc#1132542)
• Change Neutron default log level from DEBUG to INFO (SCRD-7132)
• SCRD-9031 Change permitted nova-rootwrap config file pattern (bsc#1132542)
• specify rootwrap config file in nova sudoer (bsc#1132542)
• Change Nova default log level from DEBUG to INFO (SCRD-7132)
• Stop installing a sudoers root escalator (SCRD-9031)
• Change Octavia default log level from DEBUG to INFO (SCRD-7132)
• Increase number of connect retries (SCRD-7496)
• UDEV rules for multi-port nics (SCRD-8329)
• Ensure that the ceph group exists (SCRD-8347)
• Disable test_create_health_monitor_with_scenarios tempest (SOC-9176)
• Make --os-test-timeout configurable and increase default (SCRD-7496)
• Disable TestVolumeBootPattern.test_volume_boot_pattern (SCRD-9015)
• Increase and make timeout values configurable (SCRD-7496)
• Configure heat boot config template path (SCRD-7496)
• Fix typo on ceilometer filter (SCRD-7496)
• barclamp: Fix setting MTU on networks using a bridge
• Fix order of values in nodes piechart
• Ignore CVE-2019-11068 during Travis (SOC-9262)
• Fix cloud-mkcloud9-job-backup-restore (SCRD-7126)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• pacemaker: add failure nodes to sync fail message (bsc#1083721)
• update suse-branding.patch (SOC-9297)
• pacemaker: wait more for founder if SBD is configured (SCRD-8462)
• pacemaker: don't check cluster members on founder (SCRD-8462)
• database: Make wsrep_provider_options configurable (fate#327745)
• database: Raise and align promote/demote timeouts (bsc#1131791)
• mysql: improve galera HA setup (bsc#1122875)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• neutron: Fix the rest of the keystone related settings for LBaaS
• neutron: properly define neutron lbaas region (bsc#1128753)
• CLM - update MariaDB manually (bsc#1132852, SOC-9022)
• update MariaDB manually (bsc#1132852, SOC-9022)
• SOC8 alarm table restructure ((SCRD-7710, bsc#1124170)
• Fix bsc#1118003
• add deprecation decision tree (shrub) (SCRD-8530)
• add cert section (SCRD-5542)
• grammar; make migration pairing more explicit (SCRD-7595)
• Remove whitespace on top of login page (SCRD-7142)
• Revert alert and form colors to default SCRD-6919
• Change active sidebar section text white SCRD-6919
• Updated the openstack-monasca-agent-sudoers file (bsc#1132542)
• Don't restart neutron-ovs-cleanup on RPM update (bsc#1132860)
• Fix KeyError in OVS firewall (bsc#1131712, CVE-2019-10876)
• update to 1.11.20 (bsc#124991, CVE-2019-6975):
• Memory exhaustion in django.utils.numberformat.format()
• Include ops-console logs if exist (bsc-1126912)
• Add a sed pattern to censor passwords from servers.yml (bsc#1105559)
• Show the status file of crowbar upgrade (if it exists)

This update for rmt-server to version 2.3.1 fixes the following issues:

• Fix mirroring logic when errors are encountered (bsc#1140492)
• Refactor RMT::Mirror to download metadata/licenses in parallel
• Check repo metadata GPG signatures during mirroring (bsc#1132690)
• Add rmt-server-config subpackage with nginx configs (fate#327816, bsc#1136081)
• Fix dependency to removed boot_cli_i18n file (bsc#1136020)
• Add rmt-cli systems list command to list registered systems
• Fix create UUID when system_uuid file empty (bsc#1138316)
• Fix duplicate nginx location in rmt-server-pubcloud (bsc#1135222)
• Mirror additional repos that were enabled during mirroring (bsc#1132690)
• Make service IDs consistent across different RMT instances (bsc#1134428)
• Make SMT data import scripts faster (bsc#1134190)
• Fix incorrect triggering of registration sharing (bsc#1129392)
• Fix license mirroring issue in some non-SUSE repositories (bsc#1128858)
• Update dependencies to fix vulnerabilities in rails (CVE-2019-5419, bsc#1129271) and nokogiri (CVE-2019-11068, bsc#1132160)
• Allow RMT registration to work under HTTP as well as HTTPS.
• Offline migration from SLE 15 to SLE 15 SP1 will add Python2 module
• Online migrations will automatically add additional modules to the client systems depending on the base product
• Supply log severity to journald
• Breaking Change: Added headers to generated CSV files

This update for ardana package fixes the following issues:

• Update to version 9.0+git.1560211997.7ac9792:

  • Adds repository list parameter (bsc#1122825)

• Update to version 9.0+git.1557219331.457b6e7:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559292830.208d258:

  • Convert number of workers to int (SOC-9418)

• Update to version 9.0+git.1557424689.2b085d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1556225774.492d42c:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220194.6a90deb:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219517.7b97993:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559039284.6fc1d47:

  • Convert number of workers to int (SOC-9384)

• Update to version 9.0+git.1558583814.a96bada:

  • Restrict rootwrap directories for cinder (bsc#1132542)

• Update to version 9.0+git.1557421539.521a486:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219553.d850ca4:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219586.7c96a6d:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219626.b190680:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1560868957.42bcb70:

  • MariaDB conf changes IPv6 (SOC-9089)

• Update to version 9.0+git.1559351643.a440414:

  • Configure xinted mysqlchk to accept ipv6 (SOC-9369)

• Update to version 9.0+git.1557219651.3d4d2d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1554995553.23d9513:

  • Configurable innodb flush options (SCRD-7496)

• Switch to new Gerrit Server

• Update to version 9.0+git.1558588538.9211022:

  • Secure designate's rootwrap files (bsc#1132542)

• Update to version 9.0+git.1558549508.9bfa9e7:

  • specify rootwrap config file in designate sudoer (bsc#1132542)

• Update to version 9.0+git.1557219686.0e71bf9:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559033522.5e5be1c:

  • Convert number of workers to int (SOC-9381)

• Update to version 9.0+git.1557421456.f1e5016:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219717.fe1bde6:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559036788.b727b53:

  • Convert number of workers to int (SOC-9382)

• Update to version 9.0+git.1557421526.a8c13bf:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219773.fe2f6aa:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219807.6036a8e:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220534.883f8c9:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1557189507.c786525:

  • add external network to Ironic multi-tenancy input model (SCRD-8930)

• Update to version 9.0+git.1557189482.8931e67:

  • add neutron_l3_agent plugin (SCRD-8929)

• Switch to new Gerrit Server

• Update to version 9.0+git.1556199488.bdf1cdc:

  • SCRD-7471 Don't set external-name in ardana-ci models (SCRD-7471)

• Update to version 9.0+git.1559171053.476225c:

  • Move keystone error url to locale bundle (SOC-3456)
  • Add doc link to 503 error from Keystone (SOC-3456)

• Update to version 9.0+git.1558732415.467c8ab:

  • Consolidate setCloseButtonDisabled
  • Disable close button when playbook or action in progress
  • Disable close button when playbook or action in progress
  • Updated comments
  • Fixed an issue for replacing controller page
  • Prevent operations when…

It was discovered that Libxslt incorrectly handled certain documents. An attacker could possibly use this issue to access sensitive information.