CVE-2011-1425 EXPLOIT
5.1
MEDIUM · CVSS 2.0 · EPSS 8.1% (pctl 95)
Patch early
A public exploit exists.
Description
xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.
Scoring
| CVSS | 5.1 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:P |
| EPSS | 8.06% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-264 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2011-04-04 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| aleksey | xml security library |
| apple | webkit |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apple Safari Webkit - libxslt Arbitrary File Creation (Metasploit) | 2011-10-18 |
References
- http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780
- http://git.gnome.org/browse/xmlsec/commit/?id=35eaacde6093d6711339754fc2146341b8b9f5fa
- http://secunia.com/advisories/43920
- http://secunia.com/advisories/44167
- http://secunia.com/advisories/44423
- http://trac.webkit.org/changeset/79159
- http://www.aleksey.com/pipermail/xmlsec/2011/009120.html
- http://www.debian.org/security/2011/dsa-2219
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:063
- http://www.redhat.com/support/errata/RHSA-2011-0486.html
- http://www.securityfocus.com/bid/47135
- http://www.securitytracker.com/id?1025284
- http://www.vupen.com/english/advisories/2011/0855
- http://www.vupen.com/english/advisories/2011/0858
- http://www.vupen.com/english/advisories/2011/1010
- http://www.vupen.com/english/advisories/2011/1172
- https://bugs.webkit.org/show_bug.cgi?id=52688
- https://bugzilla.redhat.com/show_bug.cgi?id=692133
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66506
- http://git.gnome.org/browse/xmlsec/commit/?id=2d5eddcc4163ea050cf3a3a1a25452bb5124f780
→ the Explorer · watch your stack · NVD