xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xmlsec1-nss-develUpgrade xmlsec1Upgrade xmlsec1-opensslUpgrade xmlsec1-gnutlsUpgrade xmlsec1-nssUpgrade xmlsec1-openssl-develUpgrade xmlsec1-gnutls-develUpgrade xmlsec1-devel | Dec 1, 2016 | Apr 4, 2011 |
| Debian | — | Upgrade xmlsec1 | Jul 30, 2024 | Apr 4, 2011 |
| Gentoo Linux | — | Upgrade dev-libs/xmlsec.Upgrade net-libs/libsoup.Upgrade media-libs/fmod.Upgrade net-misc/vino.Upgrade dev-php/PEAR-Mail.Upgrade net-analyzer/sflowtool.Upgrade app-admin/syslog-ng.Upgrade sys-fs/lvm2.Upgrade net-misc/rsync.Upgrade app-office/gnucash.Upgrade sys-apps/shadow.Upgrade dev-php/PEAR-PEAR.Upgrade dev-db/unixODBC.Upgrade gnome-base/gdm.Upgrade dev-util/qt-creator.Upgrade sys-cluster/resource-agents.Upgrade net-libs/webkit-gtk.Upgrade x11-apps/xrdb.Upgrade app-misc/ca-certificates.Upgrade games-sports/racer-bin.Upgrade net-misc/mrouted.Upgrade media-sound/lastfmplayer.Upgrade media-libs/xine-lib.Upgrade dev-vcs/gitolite.Upgrade dev-util/oprofile. | Oct 30, 2017 | Apr 4, 2011 |
| Oracle_linux | — | Upgrade xmlsec1-openssl-develUpgrade xmlsec1-nssUpgrade xmlsec1-gnutls-develUpgrade xmlsec1-opensslUpgrade xmlsec1Upgrade xmlsec1-develUpgrade xmlsec1-gnutlsUpgrade xmlsec1-nss-devel | Oct 16, 2024 | Apr 3, 2011 |
| Ubuntu | — | Upgrade xmlsec1 | Nov 19, 2024 | Apr 4, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub