CVE-2012-2870
Fixed in a distro release EPSS 2%
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
Products: apple iphone_os, google chrome, xmlsoft libxslt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxslt | 1.1.26-14 |
| Debian 13 | libxslt | 1.1.26-14 |
| Debian 14 | libxslt | 1.1.26-14 |
| Debian 6.0 | libxslt | 1.1.26-6+squeeze2 |
| Red Hat Enterprise Linux 5 | libxslt | 0:1.1.17-4.el5_8.3 |
| Red Hat Enterprise Linux 5 | libxslt-debuginfo | 0:1.1.17-4.el5_8.3 |
| Red Hat Enterprise Linux 5 | libxslt-devel | 0:1.1.17-4.el5_8.3 |
| Red Hat Enterprise Linux 5 | libxslt-python | 0:1.1.17-4.el5_8.3 |
| Red Hat Enterprise Linux 6 | libxslt | 0:1.1.26-2.el6_3.1 |
| Red Hat Enterprise Linux 6 | libxslt-debuginfo | 0:1.1.26-2.el6_3.1 |
| Red Hat Enterprise Linux 6 | libxslt-devel | 0:1.1.26-2.el6_3.1 |
| Red Hat Enterprise Linux 6 | libxslt-python | 0:1.1.26-2.el6_3.1 |
| openSUSE Tumbleweed | chromium | 113.0.5672.92-1.1 |
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 |