CVE-2012-2870: libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service…

Unscored severity · published Aug 31, 2012

CVE-2012-2870

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service…

–

CVSS

2.5%

EPSS

On KEV

Description

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 84% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Chrome · Google

through 21.0.1180.88; 21.0.1180.0; 21.0.1180.1; 21.0.1180.2; 21.0.1180.31; 21.0.1180.32; +34 more · source: NVD

iOS · Apple

through 6.1.4; 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.1; +34 more · source: NVD