LI
Product
Libxslt
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 9Medium 4Low 0
Watch
Add Libxslt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-11068 | 9.8 | Apr 10 | libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code Affected: through 1.1.33 |
| CVE-2016-4610 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 1.1.29 |
| CVE-2016-4609 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 1.1.29 |
| CVE-2016-4608 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: through 1.1.28 |
| CVE-2016-4607 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 1.1.29 |
| CVE-2021-30560 | 8.8 | Aug 3 | Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: before 1.1.35 |
| CVE-2017-5029 | 8.8 | Apr 24 | The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android,… Affected: 1.1.29 |
| CVE-2025-24855 | 7.8 | Mar 14 | numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored Affected: before 1.1.43 |
| CVE-2024-55549 | 7.8 | Mar 14 | xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes Affected: before 1.1.43 |
| CVE-2025-7424 | 7.5 | Jul 10 | Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes Affected: All versions, or not specified |
| CVE-2019-5815 | 7.5 | Dec 11 | Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data Affected: before 1.1.33 |
| CVE-2019-18197 | 7.5 | Oct 18 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances Affected: 1.1.33 |
| CVE-2016-1684 | 7.5 | Jun 5 | numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a… Affected: through 1.1.28 |
| CVE-2016-1683 | 7.5 | Jun 5 | numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service… Affected: through 1.1.28 |
| CVE-2022-29824 | 6.5 | May 3 | In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows Affected: through 1.1.35 |
| CVE-2019-13118 | 5.3 | Jul 1 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to… Affected: 1.1.33 |
| CVE-2019-13117 | 5.3 | Jul 1 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers Affected: 1.1.33 |
| CVE-2015-9019 | 5.3 | Apr 5 | In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce… Affected: through 1.1.29 |
| CVE-2015-7995 | – | Nov 17 | The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted… Affected: through 1.1.28 |
| CVE-2013-4520 | – | Dec 14 | xslt.c in libxslt before 1.1.25 allows context-dependent attackers to cause a denial of service (crash) via a stylesheet that embeds a DTD, which causes a structure to be accessed… Affected: through 1.1.24; 0.0.1; 0.1.0; 0.2.0; 0.3.0; 0.4.0; +34 more |
| CVE-2012-6139 | – | Apr 12 | libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey… Affected: through 1.1.27; 0.0.1; 0.1.0; 0.2.0; 0.3.0; 0.4.0; +34 more |
| CVE-2012-2870 | – | Aug 31 | libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service… Affected: through 1.1.26; 1.1.8; 1.1.9; 1.1.10; 1.1.11; 1.1.12; +12 more |
| CVE-2011-3970 | – | Feb 9 | libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors Affected: through 1.1.26 |
| CVE-2011-1202 | – | Mar 11 | The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to… Affected: through 1.1.26 |
| CVE-2008-2935 | – | Aug 1 | Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in… Affected: 1.1.8; 1.1.9; 1.1.10; 1.1.11; 1.1.12; 1.1.13; +11 more |
Showing 25