(Apple Issues Fix for iOS) libxslt generate-id() Discloses Heap Addresses to Remote Users
|
|
SecurityTracker Alert ID: 1025366 |
|
SecurityTracker URL: http://securitytracker.com/id/1025366
|
|
CVE Reference:
CVE-2011-0195
(Links to External Site)
|
Date: Apr 14 2011
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in libxslt. A remote user can obtain memory addresses on the heap.
A remote user can create specially crafted HTML that, when loaded by the target user, will exploit a flaw in the generate-id() XPath function to determine addresses on the heap. This may assist the remote user in bypassing address space layout randomization protection.
Chris Evans of Google Chrome Security Team reported this vulnerability.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will disclose memory addresses on the heap.
|
Solution:
Apple has issued a fix for iOS (4.3.2) for iPhone 3GS and later, iPod touch, and iPad.
The Apple advisory is available at:
http://support.apple.com/kb/HT4606
|
Vendor URL: xmlsoft.org/XSLT/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
iOS
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 14 Apr 2011 20:59:49 +0000
Subject: libxslt
|
APPLE-SA-2011-04-14-1 iOS 4.3.2 Software Update
libxslt
Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact: Visiting a maliciously crafted website may lead to the
disclosure of addresses on the heap
Description: libxslt's implementation of the generate-id() XPath
function disclosed the address of a heap buffer. Visiting a
maliciously crafted website may lead to the disclosure of addresses
on the heap, which may aid in bypassing address space layout
randomization protection. This issue is addressed by generating an ID
based on the difference between the addresses of two heap buffers.
CVE-ID
CVE-2011-0195 : Chris Evans of Google Chrome Security Team
|
|
