CVE-2011-1425

Published: Apr 4, 2011Modified: Apr 29, 2026

5.1

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability: 4.9 / Impact: 6.4

Source: NVD

Description

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Affected (44)

Products: Aleksey: Xml Security Library · Apple: Webkit

1 product

Xml Security Library

1 product

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Aleksey Xml Security Library	Up to 1.2.16
Aleksey Xml Security Library	Version 0.0.10
Aleksey Xml Security Library	Version 0.0.11
Aleksey Xml Security Library	Version 0.0.12
Aleksey Xml Security Library	Version 0.0.13
Aleksey Xml Security Library	Version 0.0.14
Aleksey Xml Security Library	Version 0.0.15
Aleksey Xml Security Library	Version 0.0.1
Aleksey Xml Security Library	Version 0.0.2
Aleksey Xml Security Library	Version 0.0.2a
Aleksey Xml Security Library	Version 0.0.3
Aleksey Xml Security Library	Version 0.0.4
Aleksey Xml Security Library	Version 0.0.5
Aleksey Xml Security Library	Version 0.0.6
Aleksey Xml Security Library	Version 0.0.7
Aleksey Xml Security Library	Version 0.0.8
Aleksey Xml Security Library	Version 0.0.9
Aleksey Xml Security Library	Version 0.1.0
Aleksey Xml Security Library	Version 0.1.1
Aleksey Xml Security Library	Version 1.0.0
Aleksey Xml Security Library	Version 1.0.0 rc1
Aleksey Xml Security Library	Version 1.0.1
Aleksey Xml Security Library	Version 1.0.2
Aleksey Xml Security Library	Version 1.0.3
Aleksey Xml Security Library	Version 1.0.4
Aleksey Xml Security Library	Version 1.1.0
Aleksey Xml Security Library	Version 1.1.1
Aleksey Xml Security Library	Version 1.1.2
Aleksey Xml Security Library	Version 1.2.0
Aleksey Xml Security Library	Version 1.2.10
Aleksey Xml Security Library	Version 1.2.11
Aleksey Xml Security Library	Version 1.2.13
Aleksey Xml Security Library	Version 1.2.14
Aleksey Xml Security Library	Version 1.2.15
Aleksey Xml Security Library	Version 1.2.1
Aleksey Xml Security Library	Version 1.2.2
Aleksey Xml Security Library	Version 1.2.3
Aleksey Xml Security Library	Version 1.2.4
Aleksey Xml Security Library	Version 1.2.5
Aleksey Xml Security Library	Version 1.2.6
Aleksey Xml Security Library	Version 1.2.7
Aleksey Xml Security Library	Version 1.2.8
Aleksey Xml Security Library	Version 1.2.9
Apple Webkit	All versions

Related CWEs

References (38)

http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780

Source: cve@mitre.org

Patch

http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d6711339754fc2146341b8b9f5fa

Source: cve@mitre.org

Patch

http://secunia.com/advisories/43920

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/44167

Source: cve@mitre.org

http://secunia.com/advisories/44423

Source: cve@mitre.org

http://trac.webkit.org/changeset/79159

Source: cve@mitre.org

http://www.aleksey.com/pipermail/xmlsec/2011/009120.html

Source: cve@mitre.org

Patch

http://www.debian.org/security/2011/dsa-2219

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2011:063

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2011-0486.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/47135

Source: cve@mitre.org

http://www.securitytracker.com/id?1025284

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/0855

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/0858

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/1010

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2011/1172

Source: cve@mitre.org

https://bugs.webkit.org/show_bug.cgi?id=52688

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=692133

Source: cve@mitre.org

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/66506

Source: cve@mitre.org

http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d6711339754fc2146341b8b9f5fa

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/43920

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/44167

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/44423

Source: af854a3a-2127-422b-91ae-364da2661108

http://trac.webkit.org/changeset/79159

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.aleksey.com/pipermail/xmlsec/2011/009120.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.debian.org/security/2011/dsa-2219

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2011:063

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2011-0486.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/47135

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025284

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0855

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0858

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/1010

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/1172

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.webkit.org/show_bug.cgi?id=52688

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=692133

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/66506

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.