CVE-2017-5029

State: Published
Severity: Not scored
Published: Apr 24, 2017
Updated: Aug 5, 2024
Reserved: Jan 2, 2017

Description

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Androidn/a	Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for AndroidAffected

References

https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5
1038157vdb-entry
https://crbug.com/676623
DSA-3810vendor-advisory
96767vdb-entry
RHSA-2017:0499vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.