In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html
• http://seclists.org/fulldisclosure/2019/Aug/11
• http://seclists.org/fulldisclosure/2019/Aug/13
• http://seclists.org/fulldisclosure/2019/Aug/14
• http://seclists.org/fulldisclosure/2019/Aug/15
• http://seclists.org/fulldisclosure/2019/Jul/22
• http://seclists.org/fulldisclosure/2019/Jul/23
• http://seclists.org/fulldisclosure/2019/Jul/24
• http://seclists.org/fulldisclosure/2019/Jul/26
• http://seclists.org/fulldisclosure/2019/Jul/31

Related CVEs