What’s Vulnerable › Vulnerabilities

CVE-2011-1202

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2011-03-11 · updated 2026-06-16
• Weakness: CWE-200

Description

The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.

Affected products

• Google Chrome: before 10.0.648.127 — fixed in 10.0.648.127
• xmlsoft libxslt: through 1.1.26

How to fix

Upgrade to a fixed version: Google Chrome 10.0.648.127. Check the vendor advisory for mitigations.

References

• http://code.google.com/p/chromium/issues/detail?id=73716
• http://downloads.avaya.com/css/P8/documents/100144158
• http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f
• http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html
• http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:079
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:164
• http://www.securityfocus.com/bid/46785
• http://www.vupen.com/english/advisories/2011/0628
• https://bugzilla.redhat.com/show_bug.cgi?id=684386
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65966
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14244

Get alerted when CVE-2011-1202 or the next vulnerability affects your stack