The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxslt | Aug 30, 2017 | Apr 24, 2017 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 29, 2017 | Mar 29, 2017 |
| Apple Osx Libxslt | — | Upgrade macOS to the latest versionApply OS X security update 2017-001 El Capitan | Mar 29, 2017 | Mar 29, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 24, 2017 |
| Centos_linux | — | Upgrade chromium-browserUpgrade chromium-browser-debuginfo | Aug 28, 2019 | Apr 24, 2017 |
| Debian | — | Upgrade libxslt | Mar 18, 2017 | Mar 9, 2017 |
| Freebsd | — | Upgrade gitlabUpgrade chromiumUpgrade chromium-pulseUpgrade chromium-npapi | Sep 14, 2017 | Sep 14, 2017 |
| Gentoo Linux | — | Upgrade dev-libs/libxslt. | Apr 5, 2018 | Apr 24, 2017 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | May 1, 2017 | Mar 9, 2017 |
| Oracle Solaris | — | Upgrade library/python/libxsl-27 to version 1.1.33-11.4.8.0.1.1.0 on Solaris 11.4Upgrade library/libxslt to version 1.1.33-0.175.3.36.0.19.0 on Solaris 11.3Upgrade library/python/libxsl-27 to version 1.1.33-0.175.3.36.0.19.0 on Solaris 11.3Upgrade library/libxslt to version 1.1.33-11.4.8.0.1.1.0 on Solaris 11.4 | Apr 17, 2019 | Apr 24, 2017 |
| Redhat_linux | — | Upgrade chromium-browserUpgrade chromium-browser-debuginfo | Mar 19, 2017 | Mar 9, 2017 |
| Suse | — | Upgrade libxslt-develUpgrade libxslt-pythonUpgrade libxslt-32bitUpgrade libxslt-x86Upgrade libxslt-toolsUpgrade chromedriverUpgrade chromiumUpgrade libxslt-devel-32bitUpgrade ruby2.5-rubygem-nokogiriUpgrade libxsltUpgrade libxslt1-32bitUpgrade libxslt1 | Mar 18, 2017 | Mar 9, 2017 |
| Ubuntu | — | Upgrade libxslt1.1Upgrade liboxideqtcore0 | Mar 30, 2017 | Mar 9, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub