Ubuntu Security Notice 633-1 - It was discovered that long transformation matches in libxslt could overflow. If an attacker were able to make an application linked against libxslt process malicious XSL style sheet input, they could execute arbitrary code with user privileges or cause the application to crash, leading to a denial of service. Chris Evans discovered that the RC4 processing code in libxslt did not correctly handle corrupted key information. If a remote attacker were able to make an application linked against libxslt process malicious XML input, they could crash the application, leading to a denial of service.
e71216d18a9188ff3b39ec48cf95a6d26780525826bce9c5ed7d5bb63c139134Mandriva Linux Security Advisory - A buffer overflow vulnerability in libxslt could be exploited via an XSL style sheet file with a long XLST transformation match condition, which could possibly lead to the execution of arbitrary code. The updated packages have been patched to correct this issue.
d77255632167d8e079334e1ac6dc2207c1e4054933ef0bd049ea348c40534cafGentoo Linux Security Advisory GLSA 200806-02 - Anthony de Almeida Lopes reported a vulnerability in libxslt when handling XSL style-sheet files, which could be exploited to trigger the use of uninitialized memory, e.g. in a call to free(). Versions less than 1.1.24 are affected.
dd80cca4ccf8f40fddcf806239995324c95cfa78db36e7280dc165d51db08d8bDebian Security Advisory 1589-1 - It was discovered that libxslt, an XSLT processing runtime library, could be coerced into executing arbitrary code via a buffer overflow when an XSL style sheet file with a long XSLT "transformation match" condition triggered a large number of steps.
3f71ed6525424de09bdb4c065d5f0d71884755d3d298d7a2f09c76bf171bc7cf
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed