CVE-2017-5029 Nokogiri implementation of libxslt lacks integer overflow checks
HighCVSS 8.8
EPSS 2.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems nokogiri(RubyGems) | < 1.7.2 | 1.7.2 |
| rubygems nokogiri(RubyGems) | = 1.0.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.0.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.1.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.1.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.2.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.3.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.3.1 | No fix listed |
Show 108 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems nokogiri(RubyGems) | = 1.4.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.4.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.4.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.0.beta.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.1.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.10 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.11 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.3.rc6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.4.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.5.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.5.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.5.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.6 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.6.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.6.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.6.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.7.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.7.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.7.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.8 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.5.9 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.0.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.2.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.3.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.4.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.5 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.6.4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.7.rc4 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.8 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.8.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.8.rc1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.8.rc2 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.6.8.rc3 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.7.0 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.7.0.1 | No fix listed |
| rubygems nokogiri(RubyGems) | = 1.7.1 | No fix listed |
| debian/libxslt(Debian:12) | < 1.1.29-2.1 | 1.1.29-2.1 |
| debian/libxslt(Debian:13) | < 1.1.29-2.1 | 1.1.29-2.1 |
| debian/libxslt(Debian:14) | < 1.1.29-2.1 | 1.1.29-2.1 |
| Google Chrome | <= 57.0.2987.75 | No fix listed |
| Google Chrome | <= 57.0.2987.100 | No fix listed |
| xmlsoft libxslt | = 1.1.29 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| alpine/libxslt(Alpine:v3.10) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.11) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.12) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.13) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.14) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.15) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.16) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.17) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.18) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.19) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.2) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.20) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.21) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.22) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.23) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.24) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.3) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.4) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.5) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.6) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.7) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.8) | < 1.1.29-r1 | 1.1.29-r1 |
| alpine/libxslt(Alpine:v3.9) | < 1.1.29-r1 | 1.1.29-r1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- git.gnome.org
- github.com vendor-advisory
- github.com
- github.com exploit
- ubuntu.com
- ubuntu.com
- github.com product
- Debian Security Tracker CVE-2017-5029 vendor-advisory
- RHSA-2017:0499 vendor-advisory
- DSA-3810 vendor-advisory
- 96767 vdb-entry
- 1038157 vdb-entry
- chromereleases.googleblog.com
- crbug.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking