CVE-2019-15587

Source

https://nvd.nist.gov/vuln/detail/CVE-2019-15587

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15587.json

Aliases

• GHSA-c3gv-9cxf-6f57

Related

• DSA-4554-1
• USN-4498-1

Published

2019-10-22T21:15:10Z

Modified

2023-11-29T07:08:12.654723Z

Details

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

References

• https://security.netapp.com/advisory/ntap-20191122-0003/
• https://www.debian.org/security/2019/dsa-4554
• https://github.com/flavorjones/loofah/issues/171
• https://hackerone.com/reports/709009
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5/
• https://usn.ubuntu.com/4498-1/