(Apple Issues Fix for iOS) libxslt generate-id() Discloses Heap Addresses to Remote Users
|
|
SecurityTracker Alert ID: 1025366 |
|
SecurityTracker URL: http://securitytracker.com/id/1025366
|
|
CVE Reference:
CVE-2011-0195
(Links to External Site)
|
Date: Apr 14 2011
|
Impact:
Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in libxslt. A remote user can obtain memory addresses on the heap.
A remote user can create specially crafted HTML that, when loaded by the target user, will exploit a flaw in the generate-id() XPath function to determine addresses on the heap. This may assist the remote user in bypassing address space layout randomization protection.
Chris Evans of Google Chrome Security Team reported this vulnerability.
|
Impact:
A remote user can create HTML that, when loaded by the target user, will disclose memory addresses on the heap.
|
Solution:
Apple has issued a fix for iOS (4.3.2) for iPhone 3GS and later, iPod touch, and iPad.
The Apple advisory is available at:
http://support.apple.com/kb/HT4606
|
Vendor URL: xmlsoft.org/XSLT/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS: Apple (iOS)
|
Underlying OS Comments: prior to 4.3.2 (iPhone 3GS and later, iPod touch, and iPad)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
