Adobe Acrobat and Reader Buffer Overflow (APSB17-01: CVE-2017-2948)

A buffer overflow vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing a corrupted PDF file containing an XSL stylesheet. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

Adobe Acrobat and Reader Heap Overflow (APSB17-01: CVE-2017-2949)

A heap overflow vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing a corrupted PDF file containing an XSL stylesheet. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

[SECURITY] Fedora 23 Update: openvas-gsa-6.0.11-3.fc23

The Greenbone Security Assistant GSA is a lean web service offering a user web interface for the Open Vulnerability Assessment System OpenVAS. The GSA uses XSL transformation style-sheets that converts OMP responses from the OpenVAS infrastructure into presentable HTML...

[SECURITY] Fedora 24 Update: openvas-gsa-6.0.11-3.fc24

The Greenbone Security Assistant GSA is a lean web service offering a user web interface for the Open Vulnerability Assessment System OpenVAS. The GSA uses XSL transformation style-sheets that converts OMP responses from the OpenVAS infrastructure into presentable HTML...

[SECURITY] Fedora 25 Update: openvas-gsa-6.0.11-3.fc25

The Greenbone Security Assistant GSA is a lean web service offering a user web interface for the Open Vulnerability Assessment System OpenVAS. The GSA uses XSL transformation style-sheets that converts OMP responses from the OpenVAS infrastructure into presentable HTML...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

Hippo CMS: source code security analysis report

Several vulnerabilities were discovered in Hippo 'Hippo CMS' software: Using XSL Transformation to Execute Any Code Violating the Java Object Model Missing XML document schema validation Using Broken or Risky Cryptographic Algorithm Incorrect Permissions for External Entities During XML Document...

Enonic XP: source code security analysis report

Several vulnerabilities were discovered in Enonic AS 'Enonic XP' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из недоверенных источников HttpOnly...

The vulnerability of the LibXLST transformation library allows a attacker to cause a service failure or exert other effects.

The vulnerability of the numbers.c file in the XLST transformation library LibXLST is related to incorrect processing of the xsl:number format. Exploiting this vulnerability can allow a malicious actor to cause service failures or other effects through a specially crafted document...

DEBIAN-CVE-2016-1684

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service integer overflow or resource consumption or possibly have unspecified other impact via a crafted document...

chromium-browser: integer overflow in libxslt

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service integer overflow or resource consumption or possibly have unspecified other impact via a crafted document...

LogicalDoc Document Managment System CE: source code security analysis report

Several vulnerabilities were discovered in LogicalDOC 'LogicalDoc Document Managment System CE' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из...

CVE-2015-6838

CVE-2015-6838 affects PHP’s XSLTProcessor (ext/xsl/xsltprocessor.c). When libxml2 before 2.9.2 is used, the code does not guard the return value of valuePop(), allowing a NULL pointer dereference that can crash the application (denial of service). The vulnerability is documented as: PHP versions ...

CVE-2015-6838: Undefined Security Weakness

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument...

Allfresco Community Edition: source code security analysis report

Several vulnerabilities were discovered in Alfresco Software 'Allfresco Community Edition' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Использование метода finalize Отсутствие верификации цифровой подписи исполняемых...

Apache Apex: source code security analysis report

Several vulnerabilities were discovered in The Apache Software Foundation 'Apache Apex' software: Using XSL Transformation to Execute Any Code Missing Verification of Executable Files' Digital Signature when Executing them from Untrusted Sources HttpOnly Cookies Incorrect User Input Filtration wh...

[SECURITY] Fedora 23 Update: openvas-gsa-6.0.10-3.fc23

The Greenbone Security Assistant GSA is a lean web service offering a user web interface for the Open Vulnerability Assessment System OpenVAS. The GSA uses XSL transformation style-sheets that converts OMP responses from the OpenVAS infrastructure into presentable HTML...

Fedora 22 : php-5.6.19-1.fc22 (2016-baa32758d0)

03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...

Fedora 23 : php-5.6.19-1.fc23 (2016-c0853ea24e)

03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...

Xalan-Java: insufficient constraints in secure processing feature

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations XSLT content to be processed by an application using Xalan-Java could use this...