Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-57436 →
DEBIAN-CVE-2026-57436
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
ruby-nokogiri
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
ruby-nokogiri
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
ruby-nokogiri
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org