Unscored severity · published Mar 11, 2011
CVE-2011-1202
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to…
–
CVSS
2.5%
EPSS
No
On KEV
Description
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
before 10.0.648.127 · source: NVD
LI
Libxslt · Xmlsoft
through 1.1.26 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1202
Exploit
http://code.google.com/p/chromium/issues/detail?id=73716
Third Party Advisory
http://downloads.avaya.com/css/P8/documents/100144158
Patch
http://git.gnome.org/browse/libxslt/commit/?id=ecb6bcb8d1b7e44842edde3929f412d46b40c89f
Vendor Advisory
http://googlechromereleases.blogspot.com/2011/03/chrome-stable-release.html
Third Party Advisory
http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:079
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability