CVE-2019-11068: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Affected products

Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
Debian Debian Linux: version 8.0 only
Fedoraproject Fedora: version 29 only; version 30 only
Netapp Active Iq Unified Manager: affected versions not specified
Netapp Cloud Backup: affected versions not specified
Netapp E-Series Santricity Management Plug-Ins: affected versions not specified
Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.2
Netapp E-Series Santricity Storage Manager: affected versions not specified
Netapp E-Series Santricity Unified Manager: affected versions not specified
Netapp E-Series Santricity Web Services Proxy: affected versions not specified
Netapp Element Software: affected versions not specified
Netapp Hci Management Node: affected versions not specified
Netapp Oncommand Insight: affected versions not specified
Netapp Oncommand Workflow Automation: affected versions not specified
Netapp Plug-In For Symantec Netbackup: affected versions not specified
Netapp Santricity Unified Manager: affected versions not specified
Netapp Snapmanager: affected versions not specified
Netapp Solidfire: affected versions not specified
Netapp Steelstore Cloud Integrated Storage: affected versions not specified
Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only
Oracle JDK: version 8.0 only
Xmlsoft Libxslt: up to and including 1.1.33

Published 2019-04-10. Last modified 2026-06-17.