Bug 358615 – <dev-libs/libxslt-1.1.26-r1: Heap address leak (CVE-2011-1202)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Paweł Hajdan, Jr. (RETIRED) 2011-03-12 20:41:40 UTC]

Chris Evans discovered a heap address leak in XSLT
The bug is in the generate-id() XPath function, and is 
sometimes used in XSL transforms. 
This is a low severity information leak, that does not
corrupt anything, However it can be paired with other 
bugs and can be perhaps used as an exploit aid against
ASLR.

References:
http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html
http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f

https://bugzilla.redhat.com/show_bug.cgi?id=684386

[Comment 1 Pacho Ramos 2011-03-12 20:59:11 UTC]

+*libxslt-1.1.26-r1 (12 Mar 2011)
+
+  12 Mar 2011; Pacho Ramos <[e-mail]> +libxslt-1.1.26-r1.ebuild,
+  +files/libxslt-1.1.26-id-generation.patch:
+  Fix heap address leak (CVE-2011-1202).
+

[Comment 2 Paweł Hajdan, Jr. (RETIRED) 2011-03-13 08:41:22 UTC]

Thank you. Arches, please stabilize =dev-libs/libxslt-1.1.26-r1

[Comment 3 Kacper Kowalik (Xarthisius) (RETIRED) 2011-03-13 12:18:50 UTC]

ppc/ppc64 stable

[Comment 4 Agostino Sarubbo 2011-03-13 13:23:33 UTC]

amd64 ok

[Comment 5 Christian Faulhammer (RETIRED) 2011-03-13 14:33:34 UTC]

x86 stable

[Comment 6 Markos Chandras (RETIRED) 2011-03-13 15:49:06 UTC]

amd64 done. Thanks Agostino

[Comment 7 Tobias Klausmann (RETIRED) 2011-03-13 19:01:28 UTC]

Stable on alpha

[Comment 8 Jeroen Roovers (RETIRED) 2011-03-15 15:40:45 UTC]

Stable for HPPA.

[Comment 9 Raúl Porcel (RETIRED) 2011-03-18 17:31:30 UTC]

arm/ia64/s390/sh/sparc stable

[Comment 10 Tim Sammut (RETIRED) 2011-03-19 22:41:31 UTC]

Thanks, everyone. GLSA Vote: no.

[Comment 11 Stefan Behte (RETIRED) 2011-03-29 19:51:16 UTC]

Vote: no, closing noglsa.