{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-03-08T00:00:00", "descriptions": [{"lang": "en", "value": "The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-18T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "oval:org.mitre.oval:def:14244", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244"}, {"name": "46785", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/46785"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f"}, {"name": "MDVSA-2011:079", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:079"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html"}, {"tags": ["x_refsource_MISC"], "url": "http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://code.google.com/p/chromium/issues/detail?id=73716"}, {"name": "google-xslt-info-disclosure(65966)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65966"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=684386"}, {"name": "MDVSA-2012:164", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:164"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://downloads.avaya.com/css/P8/documents/100144158"}, {"name": "ADV-2011-0628", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2011/0628"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-1202", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "oval:org.mitre.oval:def:14244", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244"}, {"name": "46785", "refsource": "BID", "url": "http://www.securityfocus.com/bid/46785"}, {"name": "http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f", "refsource": "CONFIRM", "url": "http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f"}, {"name": "MDVSA-2011:079", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:079"}, {"name": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html", "refsource": "CONFIRM", "url": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html"}, {"name": "http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html", "refsource": "MISC", "url": "http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html"}, {"name": "http://code.google.com/p/chromium/issues/detail?id=73716", "refsource": "CONFIRM", "url": "http://code.google.com/p/chromium/issues/detail?id=73716"}, {"name": "google-xslt-info-disclosure(65966)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65966"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=684386", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=684386"}, {"name": "MDVSA-2012:164", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:164"}, {"name": "http://downloads.avaya.com/css/P8/documents/100144158", "refsource": "CONFIRM", "url": "http://downloads.avaya.com/css/P8/documents/100144158"}, {"name": "ADV-2011-0628", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2011/0628"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T22:21:33.663Z"}, "title": "CVE Program Container", "references": [{"name": "oval:org.mitre.oval:def:14244", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244"}, {"name": "46785", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/46785"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f"}, {"name": "MDVSA-2011:079", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:079"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://code.google.com/p/chromium/issues/detail?id=73716"}, {"name": "google-xslt-info-disclosure(65966)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65966"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=684386"}, {"name": "MDVSA-2012:164", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:164"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://downloads.avaya.com/css/P8/documents/100144158"}, {"name": "ADV-2011-0628", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2011/0628"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-1202", "datePublished": "2011-03-11T01:00:00", "dateReserved": "2011-03-03T00:00:00", "dateUpdated": "2024-08-06T22:21:33.663Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7AD8B5C-C973-4445-B111-716D9814CE79", "versionEndExcluding": "10.0.648.127", "vulnerable": true}, {"criteria": "cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*", "matchCriteriaId": "9251F19D-BEA4-4ED4-9A4B-EA89E795C6D0", "versionEndIncluding": "1.1.26", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function."}, {"lang": "es", "value": "Vulnerabilidad no especificada en la implementaci\u00f3n XSLT en Google Chrome anterior a v10.0.648.127 permite a atacantes remotos obtener informaci\u00f3n sensible acerca de las direcciones de memoria en el mont\u00f3n mediante vectores desconocidos."}], "id": "CVE-2011-1202", "lastModified": "2020-06-04T14:16:14.097", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2011-03-11T02:01:20.200", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "http://code.google.com/p/chromium/issues/detail?id=73716"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://downloads.avaya.com/css/P8/documents/100144158"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:079"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:164"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/46785"}, {"source": "cve@mitre.org", "tags": ["Permissions Required"], "url": "http://www.vupen.com/english/advisories/2011/0628"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=684386"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65966"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2011:0471", "cpe": "cpe:/o:redhat:enterprise_linux:4", "package": "firefox-0:3.6.17-2.el4", "product_name": "Red Hat Enterprise Linux 4", "release_date": "2011-04-29T00:00:00Z"}, {"advisory": "RHSA-2011:0471", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "firefox-0:3.6.17-1.el5_6", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2011-04-29T00:00:00Z"}, {"advisory": "RHSA-2011:0471", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "xulrunner-0:1.9.2.17-3.el5_6", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2011-04-29T00:00:00Z"}, {"advisory": "RHSA-2012:1265", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "libxslt-0:1.1.17-4.el5_8.3", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2012-09-13T00:00:00Z"}, {"advisory": "RHSA-2011:0471", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:3.6.17-1.el6_0", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2011-04-29T00:00:00Z"}, {"advisory": "RHSA-2011:0471", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "xulrunner-0:1.9.2.17-4.el6_0", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2011-04-29T00:00:00Z"}, {"advisory": "RHSA-2012:1265", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "libxslt-0:1.1.26-2.el6_3.1", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2012-09-13T00:00:00Z"}], "bugzilla": {"description": "libxslt: Heap address leak in XLST", "id": "684386", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=684386"}, "csaw": false, "cvss": {"cvss_base_score": "2.6", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "status": "verified"}, "details": ["The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function."], "name": "CVE-2011-1202", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:4", "fix_state": "Will not fix", "package_name": "libxslt", "product_name": "Red Hat Enterprise Linux 4"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "mingw32-libxslt", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2011-02-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2011-1202\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-1202"], "statement": "This issue affects the versions of libxslt package as shipped with Red Hat\nEnterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this\nissue as having low security impact, a future update may address this flaw.", "threat_severity": "Low"}