CVEvulnerability
CVE-2011-1202
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-03-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
Affected configurations
• google chrome (< 10.0.648.127)
• xmlsoft libxslt (<= 1.1.26)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://code.google.com/p/chromium/issues/detail?id=73716 Exploit, Issue Tracking, Patch, Vendor Advisory
- http://downloads.avaya.com/css/P8/documents/100144158 Third Party Advisory
- http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f Patch, Third Party Advisory
- http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html Vendor Advisory
- http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:079 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:164 Third Party Advisory
- http://www.securityfocus.com/bid/46785 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/0628 Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=684386 Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65966 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244 Third Party Advisory
- http://code.google.com/p/chromium/issues/detail?id=73716 Exploit, Issue Tracking, Patch, Vendor Advisory
- http://downloads.avaya.com/css/P8/documents/100144158 Third Party Advisory
- http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f Patch, Third Party Advisory
- http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html Vendor Advisory
- http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:079 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:164 Third Party Advisory
- http://www.securityfocus.com/bid/46785 Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2011/0628 Permissions Required
- https://bugzilla.redhat.com/show_bug.cgi?id=684386 Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65966 Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244 Third Party Advisory