News
Vigil@nce: libxslt, using freed memory via XPath/generate-id
October 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use XSLT data with XPath or generate-id(), in
order to stop applications linked to libxslt, and possibly to
execute code.
– Impacted products: Fedora, RHEL, Unix (platform)
– Severity: 2/4
– Creation date: 14/09/2012
DESCRIPTION OF THE VULNERABILITY
The libxslt library processes XSLT transformations to be applied
on an XML document. It is impacted by two vulnerabilities.
The XPath language is used to indicate a location in XML data. For
example "/a/b" selects the "" element. During its usage, a
memory area previously freed is used. [severity:2/4]
The XSLT XPath generate-id() function generates a unique
identifier for a node of XML data. During its usage, a memory area
previously freed is used. [severity:2/4]
An attacker can therefore use XSLT data with XPath or
generate-id(), in order to stop applications linked to libxslt,
and possibly to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/libxslt-using-freed-memory-via-XPath-generate-id-11947
