REDHAT-BUG-1257962
First published: Fri Aug 28 2015(Updated: )
A vulnerability in function xsltStylePreCompute" in preproc.c was found, the cause of which is a type confusion leading to DoS. As reported in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED DUPLICATE - Libxslt 1.1.28 Type Confusion vulnerability may cause DOS" href="show_bug.cgi?id=1257058">https://bugzilla.redhat.com/show_bug.cgi?id=1257058</a> : """ Through analysis we get to know that parent->ns->href in line 2250 of preproc.c is an invalid value with our poc. The whole process is as follow: 1> The main function in xsltproc.c will call xmlReadFile to read a .xml file. xmlReadFile will return a xmlDocPtr which points to the xmlDoc. When we print xmlDocPtr->children->parent->ns, its value is 0xffffffff. Obviously, this value is not a correct one. 2> Later in xsltStylePreCompute of preproc.c, the function will see whether current element is 'attribute', if yes,if inst->parent!=NULL and parent->ns!=NULL, then it will call xmlStrEqual, the first parameter is a ptr but its value is 0xffffffff! 3> We went further into libxml and see why this happened.The result is : in SAX2.c +2293 of libxml, we found that the first parameter "ctxt->myDoc" is a xmlDocPtr, but it will be teated as a xmlNodePtr. Obviously, xmlDoc and xmlNode have different structure. This is why "xmlDocPtr->children->parent->ns" get a invalid value(0xffffffff), this value comes from xmlDoc->compression. """
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libxslt |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257058
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1068010
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1068010&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257982
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257983
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c4
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c9
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c11
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1086465&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1086465&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c13
- http://www.openwall.com/lists/oss-security/2015/10/27/10
- https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1257962#c18
- https://bugzilla.redhat.com/show_bug.cgi?id=1257962
Frequently Asked Questions
What is the severity of REDHAT-BUG-1257962?
The severity of REDHAT-BUG-1257962 is categorized as a Denial of Service (DoS) vulnerability due to type confusion in the xsltStylePreCompute function.
How do I fix REDHAT-BUG-1257962?
To fix REDHAT-BUG-1257962, upgrade to the latest version of Libxslt that addresses this vulnerability.
Which versions of Libxslt are affected by REDHAT-BUG-1257962?
All versions of Libxslt prior to the patch release addressing REDHAT-BUG-1257962 are potentially affected.
What causes the vulnerability REDHAT-BUG-1257962?
REDHAT-BUG-1257962 is caused by a type confusion in the xsltStylePreCompute function within preproc.c.
Is there a known exploit for REDHAT-BUG-1257962?
As of now, there are no public exploits reported specifically for REDHAT-BUG-1257962.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-7995
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/libxslt