CVE-2024-55549 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
mitre	CNA	7.8 HIGH				CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CISA-ADP	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

libxslt

bullseye	vulnerable
bullseye (security)	1.1.34-4+deb11u2 fixed
bookworm	1.1.35-1+deb12u1 fixed
bookworm (security)	1.1.35-1+deb12u1 fixed
sid	1.1.35-1.2 fixed
trixie	1.1.35-1.2 fixed

Ubuntu Releases

Ubuntu Product

Codename

libxslt

plucky	Fixed 1.1.39-0exp1ubuntu3 released
oracular	Fixed 1.1.39-0exp1ubuntu1.1 released
noble	Fixed 1.1.39-0exp1ubuntu0.24.04.1 released
jammy	Fixed 1.1.34-4ubuntu0.22.04.2 released
focal	Fixed 1.1.34-4ubuntu0.20.04.2 released
bionic	needs-triage
xenial	needs-triage
trusty	needs-triage

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Vulnerability Media Exposure

[GERMAN] Red Hat Enterprise Linux (libxslt): Schwachstelle ermöglicht DoS und Codeausführung
Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in libxslt ausnutzen, um einen Denial of Service zu verursachen beliebigen Programmcode auszuführen.
Published: 2025-04-06T22:00:00+00:00

References

https://gitlab.gnome.org/GNOME/libxslt/-/issues/127