What’s Vulnerable › Vulnerabilities

CVE-2011-1425

• Severity: medium (CVSS 5.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2011-04-04 · updated 2026-06-16
• Weakness: CWE-264

Description

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Affected products

• Aleksey Xml Security Library: through 1.2.16; 0.0.1, 0.0.2, 0.0.2a, 0.0.3, 0.0.4, 0.0.5 (+36)
• Apple Webkit: all versions

References

• http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780
• http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d6711339754fc2146341b8b9f5fa
• http://secunia.com/advisories/43920
• http://secunia.com/advisories/44167
• http://secunia.com/advisories/44423
• http://trac.webkit.org/changeset/79159
• http://www.aleksey.com/pipermail/xmlsec/2011/009120.html
• http://www.debian.org/security/2011/dsa-2219
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:063
• http://www.redhat.com/support/errata/RHSA-2011-0486.html
• http://www.securityfocus.com/bid/47135
• http://www.securitytracker.com/id?1025284

Get alerted when CVE-2011-1425 or the next vulnerability affects your stack