CVE-2019-11068
CriticalSummary
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
Risk Assessment
Organizations may be exposed to unauthorized access to data, potentially leading to information leakage or data manipulation.
Recommendation
It is recommended to update libxslt to version 1.1.34 or later to mitigate this vulnerability.
Original NVD description (English source)
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.