Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

Export CSV
CVE-2012-6139

libxslt: two DoS issues fixed in 1.1.28

libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Opensuse Xmlsoft
Products
Opensuse Libxslt
CVE-2013-4520

libxslt: DoS when reading unexpected DTD nodes in XSLT in versions prior to 1.1.25

xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, which causes a structure to be accessed as a different type. NOTE: this issue is due to an incomplete fix for CVE-2012-2825.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Xmlsoft
Products
Libxslt
CVE-2011-1202

libxslt: Heap address leak in XLST

The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.

CVSS 2.0 · 4.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Google Redhat Xmlsoft
Products
Chrome Enterprise Linux Libxslt
CVE-2019-5815

chromium-browser: Heap buffer overflow in Blink

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Debian Redhat Xmlsoft
Products
Debian Linux Rhel Extras Libxslt