PT-2013-5057 · Libxslt+1 · Libxslt+1

Published 2013-12-14 · Updated 2013-12-16 · CVE-2013-4520

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libxslt versions prior to 1.1.25

Description The issue allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, which causes a structure to be accessed as a different type. This is due to an incomplete fix for a previous issue.

Recommendations For versions prior to 1.1.25, update to version 1.1.25 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2013-4520

Affected Products

Suse

Libxslt

References · 9

• 🔥 https://gitorious.org/libxslt/libxslt/commit/7089a62b8f133b42a2981cf1f920a8b3fe9a8caa · Exploit
• 🔥 https://bugzilla.novell.com/show_bug.cgi?id=849019 · Exploit
• http://seclists.org/oss-sec/2013/q4/238 · Patch
• http://secunia.com/advisories/56072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4520 · Security Note
• http://seclists.org/oss-sec/2013/q4/239 · Patch
• https://suse.com/support/update/announcement/2013/suse-su-20131654-1.html · Vendor Advisory
• https://suse.com/support/update/announcement/2013/suse-su-20131656-1.html · Vendor Advisory
• http://osvdb.org/99671 · Note