Use after free vulnerability in Blink XSLT in Google Chrome
Summary
CVE-2021-30560: Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Affects libxslt across 2 version ranges.
< 1.1.35-r0
< 50af4e65da712ceb59f98a7feeeab2ddc3324ab9
Fixed in 1.1.35-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libxslt package is a library for parsing and manipulating XML documents using XSLT (Extensible Stylesheet Language Transformations). It is commonly used in various applications and frameworks to process XML data. The vulnerability, identified as CVE-2021-30560, exists in the Blink XSLT component of Google Chrome. It allows a remote attacker to potentially exploit heap corruption by providing a crafted HTML page.
Vulnerability Detail
The use after free vulnerability in Blink XSLT in Google Chrome prior to version 91.0.4472.164 can lead to heap corruption. This occurs when the application continues to reference memory after it has been freed, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability can be exploited by tricking a user into visiting a malicious website or opening a specially crafted HTML page.
How To Fix
Minimum fixed version
1.1.35-r0
This is the first release that contains the fix.
sudo apk add --upgrade libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the libxslt package to the fixed version as soon as possible.
Conclusion
The use after free vulnerability in Blink XSLT in Google Chrome can lead to heap corruption and potential code execution or denial of service. It is crucial to update the libxslt package to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxslt →
FAQ
A use after free vulnerability occurs when an application continues to reference memory after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
This vulnerability can be exploited by tricking a user into visiting a malicious website or opening a specially crafted HTML page. The attacker can then execute arbitrary code or cause a denial of service.
Blink XSLT is a component in Google Chrome that handles XSLT (Extensible Stylesheet Language Transformations) processing. It is responsible for transforming XML documents using XSLT stylesheets.
The impact of this vulnerability can vary depending on the attacker's intentions. It could lead to arbitrary code execution, allowing the attacker to take control of the affected system. It could also cause a denial of service by crashing the application or consuming excessive resources.
To protect yourself from this vulnerability, it is important to keep your software up to date. Ensure that you have the latest version of the libxslt package installed. Additionally, exercise caution when visiting unfamiliar websites or opening files from untrusted sources.
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
