PT-2012-1041 · Libxslt+5 · Libxslt+5
Chris Evans
·
Publicado
2012-08-30
·
Atualizado
2024-06-15
·
CVE-2012-2870
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
libxslt versions 1.1.26 and earlier
Google Chrome versions prior to 21.0.1180.89
Description
The issue is related to improper memory management in libxslt, which could allow remote attackers to cause a denial of service, potentially leading to an application crash. This can be achieved through a crafted XSLT expression that is not properly identified during XPath navigation. The problem is associated with the
xsltCompileLocationPathPattern function in libxslt/pattern.c and the xsltGenerateIdFunction function in libxslt/functions.c. Exploitation of the vulnerabilities may lead to breaches of confidentiality, integrity, and availability of protected information and can be performed remotely.Recommendations
For libxslt versions 1.1.26 and earlier, consider updating to a version later than 1.1.26 to resolve the issue.
For Google Chrome versions prior to 21.0.1180.89, update to version 21.0.1180.89 or later to fix the problem.
As a temporary workaround, consider restricting the use of XSLT expressions in libxslt until a patch is available.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Google Chrome
Red Hat
Suse
Itunes
Libxslt