CVE-2012-2870

2012-08-3100:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.019 Low

EPSS

Percentile

88.5%

JSON

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89,
does not properly manage memory, which might allow remote attackers to
cause a denial of service (application crash) via a crafted XSLT expression
that is not properly identified during XPath navigation, related to (1) the
xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the
xsltGenerateIdFunction function in libxslt/functions.c.

Bugs

Notes

Author	Note
jdstrand	mdeslaur provided the update for libxslt

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchchromium-browser< 3.0.1271.97-0ubuntu0.10.04.1UNKNOWN
ubuntu11.10noarchchromium-browser< 3.0.1271.97-0ubuntu0.11.10.1UNKNOWN
ubuntu12.04noarchchromium-browser< 3.0.1271.97-0ubuntu0.12.04.1UNKNOWN
ubuntu12.10noarchchromium-browser< 3.0.1271.97-0ubuntu0.12.10.1UNKNOWN
ubuntu8.04noarchlibxslt< 1.1.22-1ubuntu1.3UNKNOWN
ubuntu10.04noarchlibxslt< 1.1.26-1ubuntu1.1UNKNOWN
ubuntu11.04noarchlibxslt< 1.1.26-6ubuntu0.1UNKNOWN
ubuntu11.10noarchlibxslt< 1.1.26-7ubuntu0.1UNKNOWN
ubuntu12.04noarchlibxslt< 1.1.26-8ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.10.04.1	UNKNOWN
ubuntu	11.10	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.11.10.1	UNKNOWN
ubuntu	12.04	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.12.04.1	UNKNOWN
ubuntu	12.10	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.12.10.1	UNKNOWN
ubuntu	8.04	noarch	libxslt	< 1.1.22-1ubuntu1.3	UNKNOWN
ubuntu	10.04	noarch	libxslt	< 1.1.26-1ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	libxslt	< 1.1.26-6ubuntu0.1	UNKNOWN
ubuntu	11.10	noarch	libxslt	< 1.1.26-7ubuntu0.1	UNKNOWN
ubuntu	12.04	noarch	libxslt	< 1.1.26-8ubuntu1.2	UNKNOWN