PT-2012-1042 · Libxslt+4 · Libxslt+4

Inferno · Published 2012-08-31 · Updated 2024-06-15 · CVE-2012-2893

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libxslt versions prior to 22.0.1229.79

Description The issue is related to a double free vulnerability in libxslt, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This is achieved through vectors related to XSL transforms. Additionally, there are multiple vulnerabilities in the libxslt package that can lead to breaches of confidentiality, integrity, and availability of protected information, and these can be exploited remotely.

Recommendations For versions prior to 22.0.1229.79, update to version 22.0.1229.79 or later to resolve the issue. As a temporary workaround, consider restricting the use of XSL transforms until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-02885

CESA-2012_1265

CVE-2012-2893

DSA-2555-1

OPENSUSE-SU-2012_1376-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2012:1265

RHSA-2012_1265

Affected Products

Centos

Google Chrome

Red Hat

Suse

Libxslt

References · 2397

• https://bdu.fstec.ru/vul/2015-09441 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2893 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3970 · Security Note
• https://bdu.fstec.ru/vul/2015-09713 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2893 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2825 · Security Note
• http://debian.org/security/2012/dsa-2555 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:164 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1202 · Security Note
• https://osv.dev/vulnerability/CVE-2012-2893 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2893 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02885 · Security Note