CVE-2012-2871

2012-08-3100:00:00

ubuntu.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.7%

JSON

libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before
21.0.1180.89, does not properly support a cast of an unspecified variable
during handling of XSL transforms, which allows remote attackers to cause a
denial of service or possibly have unknown other impact via a crafted
document, related to the _xmlNs data structure in include/libxml/tree.h.

Bugs

Notes

Author	Note
mdeslaur	libxslt, not libxml2
jdstrand	mdeslaur provided the update for libxslt

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchchromium-browser< 3.0.1271.97-0ubuntu0.10.04.1UNKNOWN
ubuntu11.10noarchchromium-browser< 3.0.1271.97-0ubuntu0.11.10.1UNKNOWN
ubuntu12.04noarchchromium-browser< 3.0.1271.97-0ubuntu0.12.04.1UNKNOWN
ubuntu12.10noarchchromium-browser< 3.0.1271.97-0ubuntu0.12.10.1UNKNOWN
ubuntu8.04noarchlibxslt< 1.1.22-1ubuntu1.3UNKNOWN
ubuntu10.04noarchlibxslt< 1.1.26-1ubuntu1.1UNKNOWN
ubuntu11.04noarchlibxslt< 1.1.26-6ubuntu0.1UNKNOWN
ubuntu11.10noarchlibxslt< 1.1.26-7ubuntu0.1UNKNOWN
ubuntu12.04noarchlibxslt< 1.1.26-8ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.10.04.1	UNKNOWN
ubuntu	11.10	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.11.10.1	UNKNOWN
ubuntu	12.04	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.12.04.1	UNKNOWN
ubuntu	12.10	noarch	chromium-browser	< 3.0.1271.97-0ubuntu0.12.10.1	UNKNOWN
ubuntu	8.04	noarch	libxslt	< 1.1.22-1ubuntu1.3	UNKNOWN
ubuntu	10.04	noarch	libxslt	< 1.1.26-1ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	libxslt	< 1.1.26-6ubuntu0.1	UNKNOWN
ubuntu	11.10	noarch	libxslt	< 1.1.26-7ubuntu0.1	UNKNOWN
ubuntu	12.04	noarch	libxslt	< 1.1.26-8ubuntu1.2	UNKNOWN