CVE-2011-1425: xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary…

Description

xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.

Exploitation

Is it being used?

Exploit prediction (EPSS)8.1% · higher than 95% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WE

Webkit · Apple

All versions, or not specified · source: NVD

XS

Xml Security Library · Aleksey

through 1.2.16; 0.0.1; 0.0.2; 0.0.2a; 0.0.3; 0.0.4; +34 more · source: NVD