VDB

CVE-2017-5029

CVE-2017-5029 PUBLISHED CVSS 8.800000190734863 HIGH

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

EPSS 2.18% · 81.6th percentile

Risk Scores

CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
2.18%
81.6th percentile

Affected Products

VendorProductVersions
Salesforceflow
Azuremonitor
Ubuntu:14.04:LTSoxide-qt1.4.2-0ubuntu0.14.04.1, 0, 1.0.0~bzr452-0ubuntu1
Ubuntu:16.04:LTSlibxslt1.1.28-2build2, 1.1.28-2.1, 0
Ubuntu:16.04:LTSchromium-browser45.0.2454.101-0ubuntu1.1201, 48.0.2564.82-0ubuntu1.1222, 49.0.2623.108-0ubuntu1.1233
Ubuntu:14.04:LTSchromium-browser41.0.2272.76-0ubuntu0.14.04.1.1076, 45.0.2454.85-0ubuntu0.14.04.1.1097, 47.0.2526.73-0ubuntu0.14.04.1.1106
Ubuntu:16.04:LTSoxide-qt1.9.5-0ubuntu1, 1.15.8-0ubuntu0.16.04.1, 1.16.5-0ubuntu0.16.04.1
Ubuntu:14.04:LTSlibxslt1.1.28-2, 1.1.28-2build1, 0

Timeline

  • Mar 10, 2017 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 27, 2021 EPSS Score
  • Dec 29, 2021 EPSS Score
  • Mar 2, 2022 EPSS Score
  • Jul 6, 2022 EPSS Score
  • Sep 8, 2022 EPSS Score
  • Nov 10, 2022 EPSS Score
  • Mar 16, 2023 EPSS Score
  • May 18, 2023 EPSS Score
  • Jul 20, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›