libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Chris Evans discovered a heap address leak in XSLT The bug is in the generate-id() XPath function, and is sometimes used in XSL transforms. This is a low severity information leak, that does not corrupt anything, However it can be paired with other bugs and can be perhaps used as an exploit aid against ASLR.

References: http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f

This has been assigned CVE-2011-1202.

libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.