A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
Accessibility. An authentication issue was addressed with improved state management.
Accessibility. An authentication issue was addressed with improved state management.
Type Confusion vulnerability in the EXSLT <func:result> element handler of libxslt. The flaw resides in the exsltFuncResultComp() function, which walks up the node hierarchy to verify that a <func:result> is a descendant of a func:function element. If no such ancestor exists, the loop continues until the XML document node is reached, where the ns pointer is incorrectly interpreted as integer fields (compression and standalone). This type confusion results in reading memory from an unexpected address, leading to a segmentation fault or crash. Although the impact is limited to denial-of-service, the issue can be triggered remotely by processing malicious XSL stylesheets.
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.