Test ID:	1.3.6.1.4.1.25623.1.0.831746
Category:	Mandrake Local Security Checks
Title:	Mandriva Update for libxslt MDVSA-2012:164 (libxslt)
Summary:	The remote host is missing an update for the 'libxslt'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'libxslt' package(s) announced via the referenced advisory. Vulnerability Insight: Multiple vulnerabilities has been discovered and corrected in libxslt: Unspecified vulnerability in XSLT allows remote attackers to obtain potentially sensitive information about heap memory addresses via unknown vectors (CVE-2011-1202). libxslt 1.1.26 and earlier does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c (CVE-2012-2870). libxml2 2.9.0-rc1 and earlier does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h (CVE-2012-2871). Double free vulnerability in libxslt allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms (CVE-2012-2893). The updated packages have been patched to correct these issues. Affected Software/OS: libxslt on Mandriva Linux 2011.0, Mandriva Enterprise Server 5.2 Solution: Please Install the Updated Packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1202 BugTraq ID: 46785 http://www.securityfocus.com/bid/46785 http://www.mandriva.com/security/advisories?name=MDVSA-2011:079 http://www.mandriva.com/security/advisories?name=MDVSA-2012:164 http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244 http://www.vupen.com/english/advisories/2011/0628 XForce ISS Database: google-xslt-info-disclosure(65966) https://exchange.xforce.ibmcloud.com/vulnerabilities/65966 Common Vulnerability Exposure (CVE) ID: CVE-2012-2870 http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html Debian Security Information: DSA-2555 (Google Search) http://www.debian.org/security/2012/dsa-2555 http://secunia.com/advisories/50838 http://secunia.com/advisories/54886 SuSE Security Announcement: openSUSE-SU-2012:1215 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html Common Vulnerability Exposure (CVE) ID: CVE-2012-2871 XForce ISS Database: chrome-xsl-transforms-code-exec(78179) https://exchange.xforce.ibmcloud.com/vulnerabilities/78179 Common Vulnerability Exposure (CVE) ID: CVE-2012-2893 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15714 SuSE Security Announcement: openSUSE-SU-2012:1376 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00012.html
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.