CVE-2011-1202

Published: Mar 11, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.

Affected (2)

Products: Google: Chrome · Xmlsoft: Libxslt

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 10.0.648.127
Xmlsoft Libxslt	Up to 1.1.26

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (24)

http://code.google.com/p/chromium/issues/detail?id=73716

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

http://downloads.avaya.com/css/P8/documents/100144158

Source: cve@mitre.org

Third Party Advisory

http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f

Source: cve@mitre.org

PatchThird Party Advisory

http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html

Source: cve@mitre.org

Vendor Advisory

http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:079

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:164

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/46785

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2011/0628

Source: cve@mitre.org

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=684386

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/65966

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244

Source: cve@mitre.org

Third Party Advisory

http://code.google.com/p/chromium/issues/detail?id=73716

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchVendor Advisory

http://downloads.avaya.com/css/P8/documents/100144158

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:079

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:164

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/46785

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2011/0628

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=684386

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/65966

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.