Published: 24/04/2017 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome before 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote malicious user to perform an out of bounds memory write via a crafted HTML page.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google chrome
xmlsoft libxslt 1.1.29
debian debian linux 8.0
debian debian linux 9.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0

Synopsis Important: chromium-browser security update Type/Severity Security Advisory: Important Topic An update for chromium-browser is now available for Red Hat Enterprise Linux 6 SupplementaryRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability S ...

Debian Bug report logs - #858546 CVE-2017-5029: Integer overflow in xsltAddTextString Package: src:libxslt; Maintainer for src:libxslt is Debian XML/SGML Group <debian-xml-sgml-pkgs@listsaliothdebianorg>; Reported by: Raphael Hertzog <hertzog@debianorg> Date: Thu, 23 Mar 2017 10:36:01 UTC Severity: grave Tags: fi ...

Several security issues were fixed in Oxide ...

Several security issues were fixed in Libxslt ...

Several vulnerabilities have been discovered in the chromium web browser CVE-2017-5029 Holger Fuhrmannek discovered an integer overflow issue in the libxslt library CVE-2017-5030 Brendon Tiszka discovered a memory corruption issue in the v8 javascript library CVE-2017-5031 Looben Yang discovered a use-after-free issue in the ...

An integer overflow issue has been found in libxslt, leading to an out of bounds write on 64-bit systems ...

CWE-787 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5 http://www.securitytracker.com/id/1038157 https://crbug.com/676623 http://www.debian.org/security/2017/dsa-3810 http://www.securityfocus.com/bid/96767 http://rhn.redhat.com/errata/RHSA-2017-0499.html https://access.redhat.com/errata/RHSA-2017:0499 https://nvd.nist.gov https://usn.ubuntu.com/3236-1/

CVE-2017-5029

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect