CVE-2012-6139

Published: Apr 12, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.

Affected (81)

Products: Xmlsoft: Libxslt · Opensuse: Opensuse

1 product

1 product

Configuration A

77 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxslt	Up to 1.1.27
Xmlsoft Libxslt	Version 0.0.1
Xmlsoft Libxslt	Version 0.1.0
Xmlsoft Libxslt	Version 0.10.0
Xmlsoft Libxslt	Version 0.11.0
Xmlsoft Libxslt	Version 0.12.0
Xmlsoft Libxslt	Version 0.13.0
Xmlsoft Libxslt	Version 0.14.0
Xmlsoft Libxslt	Version 0.2.0
Xmlsoft Libxslt	Version 0.3.0
Xmlsoft Libxslt	Version 0.4.0
Xmlsoft Libxslt	Version 0.5.0
Xmlsoft Libxslt	Version 0.6.0
Xmlsoft Libxslt	Version 0.7.0
Xmlsoft Libxslt	Version 0.8.0
Xmlsoft Libxslt	Version 0.9.0
Xmlsoft Libxslt	Version 1.0.0
Xmlsoft Libxslt	Version 1.0.10
Xmlsoft Libxslt	Version 1.0.11
Xmlsoft Libxslt	Version 1.0.12
Xmlsoft Libxslt	Version 1.0.13
Xmlsoft Libxslt	Version 1.0.14
Xmlsoft Libxslt	Version 1.0.15
Xmlsoft Libxslt	Version 1.0.16
Xmlsoft Libxslt	Version 1.0.17
Xmlsoft Libxslt	Version 1.0.18
Xmlsoft Libxslt	Version 1.0.19
Xmlsoft Libxslt	Version 1.0.1
Xmlsoft Libxslt	Version 1.0.20
Xmlsoft Libxslt	Version 1.0.21
Xmlsoft Libxslt	Version 1.0.22
Xmlsoft Libxslt	Version 1.0.23
Xmlsoft Libxslt	Version 1.0.24
Xmlsoft Libxslt	Version 1.0.25
Xmlsoft Libxslt	Version 1.0.26
Xmlsoft Libxslt	Version 1.0.27
Xmlsoft Libxslt	Version 1.0.28
Xmlsoft Libxslt	Version 1.0.29
Xmlsoft Libxslt	Version 1.0.2
Xmlsoft Libxslt	Version 1.0.30
Xmlsoft Libxslt	Version 1.0.31
Xmlsoft Libxslt	Version 1.0.32
Xmlsoft Libxslt	Version 1.0.33
Xmlsoft Libxslt	Version 1.0.3
Xmlsoft Libxslt	Version 1.0.4
Xmlsoft Libxslt	Version 1.0.5
Xmlsoft Libxslt	Version 1.0.6
Xmlsoft Libxslt	Version 1.0.7
Xmlsoft Libxslt	Version 1.0.8
Xmlsoft Libxslt	Version 1.0.9
Xmlsoft Libxslt	Version 1.1.0
Xmlsoft Libxslt	Version 1.1.10
Xmlsoft Libxslt	Version 1.1.11
Xmlsoft Libxslt	Version 1.1.12
Xmlsoft Libxslt	Version 1.1.13
Xmlsoft Libxslt	Version 1.1.14
Xmlsoft Libxslt	Version 1.1.15
Xmlsoft Libxslt	Version 1.1.16
Xmlsoft Libxslt	Version 1.1.17
Xmlsoft Libxslt	Version 1.1.18
Xmlsoft Libxslt	Version 1.1.19
Xmlsoft Libxslt	Version 1.1.1
Xmlsoft Libxslt	Version 1.1.20
Xmlsoft Libxslt	Version 1.1.21
Xmlsoft Libxslt	Version 1.1.22
Xmlsoft Libxslt	Version 1.1.23
Xmlsoft Libxslt	Version 1.1.24
Xmlsoft Libxslt	Version 1.1.25
Xmlsoft Libxslt	Version 1.1.26
Xmlsoft Libxslt	Version 1.1.2
Xmlsoft Libxslt	Version 1.1.3
Xmlsoft Libxslt	Version 1.1.4
Xmlsoft Libxslt	Version 1.1.5
Xmlsoft Libxslt	Version 1.1.6
Xmlsoft Libxslt	Version 1.1.7
Xmlsoft Libxslt	Version 1.1.8
Xmlsoft Libxslt	Version 1.1.9

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.1
Opensuse Opensuse	Version 12.2
Opensuse Opensuse	Version 12.3

References (38)

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102065.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-04/msg00020.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-04/msg00028.html

Source: secalert@redhat.com

http://secunia.com/advisories/52745

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/52805

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/52813

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/52884

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2013/dsa-2654

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2013:141

Source: secalert@redhat.com

http://www.securitytracker.com/id/1028338

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1784-1

Source: secalert@redhat.com

http://xmlsoft.org/XSLT/news.html

Source: secalert@redhat.com

https://bugzilla.gnome.org/show_bug.cgi?id=685328

Source: secalert@redhat.com

ExploitPatch

https://bugzilla.gnome.org/show_bug.cgi?id=685330

Source: secalert@redhat.com

Patch

https://git.gnome.org/browse/libxslt/commit/?id=6c99c519d97e5fcbec7a9537d190efb442e4e833

Source: secalert@redhat.com

Patch

https://git.gnome.org/browse/libxslt/commit/?id=dc11b6b379a882418093ecc8adf11f6166682e8d

Source: secalert@redhat.com

ExploitPatch

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0107

Source: secalert@redhat.com

https://www.suse.com/support/update/announcement/2013/suse-su-20131654-1.html

Source: secalert@redhat.com

https://www.suse.com/support/update/announcement/2013/suse-su-20131656-1.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102065.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-04/msg00020.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-04/msg00028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/52745

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/52805

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/52813

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/52884

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2013/dsa-2654

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2013:141

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1028338

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1784-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://xmlsoft.org/XSLT/news.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.gnome.org/show_bug.cgi?id=685328

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://bugzilla.gnome.org/show_bug.cgi?id=685330

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://git.gnome.org/browse/libxslt/commit/?id=6c99c519d97e5fcbec7a9537d190efb442e4e833

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://git.gnome.org/browse/libxslt/commit/?id=dc11b6b379a882418093ecc8adf11f6166682e8d

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0107

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.suse.com/support/update/announcement/2013/suse-su-20131654-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.suse.com/support/update/announcement/2013/suse-su-20131656-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.