NetSight
IP …
medium5.1Public exploit code

CVE-2011-1425

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or ove…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Affected products

VendorProductAffected versions
AlekseyXml Security Library
through 1.2.16
Versions 0.0.1, 0.0.2, 0.0.2a, 0.0.3, 0.0.4
AppleWebkit
All versions

Weakness classification

CWE-264

References