Upstream information
Description
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 4.3 |
Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Access Vector | Network |
Access Complexity | Medium |
Authentication | None |
Confidentiality Impact | None |
Integrity Impact | None |
Availability Impact | Partial |
SUSE Security Advisories:
- openSUSE-SU-2012:1215-1, published Fri Dec 8 15:48:58 2023
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Leap 15.0 |
| Patchnames: openSUSE Leap 15.0 GA chromium-66.0.3359.170-lp150.1.1 |
openSUSE Tumbleweed |
| Patchnames: openSUSE Tumbleweed GA chromedriver-55.0.2883.75-3.1 openSUSE Tumbleweed GA ungoogled-chromium-113.0.5672.92-1.1 |
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 12:49:49 2013CVE page last modified: Fri Dec 8 16:53:45 2023