Description
libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxslt | 1.1.26-14.1 | — |
| Debian 13 | libxslt | 1.1.26-14.1 | — |
| Debian 12 | libxslt | 1.1.26-14.1 | — |
| Debian 6.0 | libxslt | 1.1.26-6+squeeze3 | DSA-2654-1 |
Advisories 2
- DSA-2654-1 libxslt - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
References
- USN-1784-1 vendor-advisory
- 52884 third-party-advisory
- 52813 third-party-advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=685330
- SUSE-SU-2013:1654 vendor-advisory
- SUSE-SU-2013:1656 vendor-advisory
- https://git.gnome.org/browse/libxslt/commit/?id=dc11b6b379a882418093ecc8adf11f6166682e8d
- openSUSE-SU-2013:0593 vendor-advisory
- openSUSE-SU-2013:0585 vendor-advisory
- MDVSA-2013:141 vendor-advisory
- 1028338 vdb-entry
- http://xmlsoft.org/XSLT/news.html
- 52745 third-party-advisory
- FEDORA-2013-4507 vendor-advisory
- 52805 third-party-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0107
- https://git.gnome.org/browse/libxslt/commit/?id=6c99c519d97e5fcbec7a9537d190efb442e4e833
- https://bugzilla.gnome.org/show_bug.cgi?id=685328
- DSA-2654 vendor-advisory