libxslt generate-id() Discloses Heap Addresses to Remote Users
|
|
SecurityTracker Alert ID: 1025365 |
|
SecurityTracker URL: http://securitytracker.com/id/1025365
|
|
CVE Reference:
CVE-2011-0195
(Links to External Site)
|
Date: Apr 14 2011
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in libxslt. A remote user can obtain memory addresses on the heap.
A remote user can create specially crafted HTML that, when loaded by the target user, will exploit a flaw in the generate-id() XPath function to determine addresses on the heap. This may assist the remote user in bypassing address space layout randomization protection.
Chris Evans of Google Chrome Security Team reported this vulnerability.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will disclose memory addresses on the heap.
|
Solution:
The vendor has issued a source code fix, available at:
http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f
|
Vendor URL: xmlsoft.org/XSLT/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
