{"id":"CVE-2017-5029","details":"The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.","aliases":["GHSA-pf6m-fxpq-fg8v"],"modified":"2026-03-20T11:20:00.139987Z","published":"2017-04-24T23:59:00.157Z","related":["MGASA-2017-0111","MGASA-2017-0125","SUSE-SU-2017:1282-1","SUSE-SU-2017:1313-1","openSUSE-SU-2017:0738-1","openSUSE-SU-2017:0740-1","openSUSE-SU-2024:11017-1","openSUSE-SU-2024:11340-1","openSUSE-SU-2024:11912-1","openSUSE-SU-2024:13165-1","openSUSE-SU-2024:14174-1","openSUSE-SU-2025:14697-1","openSUSE-SU-2026:10356-1"],"references":[{"type":"WEB","url":"https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5"},{"type":"WEB","url":"http://www.securityfocus.com/bid/96767"},{"type":"WEB","url":"http://www.securitytracker.com/id/1038157"},{"type":"WEB","url":"https://crbug.com/676623"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-0499.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3810"},{"type":"ARTICLE","url":"https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gnome/libxml2","events":[{"introduced":"0"},{"last_affected":"2189b59b1005976970ebadb65edbb289f9e091ff"},{"introduced":"0"},{"last_affected":"2189b59b1005976970ebadb65edbb289f9e091ff"},{"introduced":"0"},{"last_affected":"2189b59b1005976970ebadb65edbb289f9e091ff"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"6.0"}]}},{"type":"GIT","repo":"https://gitlab.gnome.org/GNOME/libxslt","events":[{"introduced":"0"},{"last_affected":"9a1b3ddf6034aa2f6a30b4b7ea4bfc3c4037cd58"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"1.1.29"}]}}],"versions":["1.1.23","1.1.24","CVE-2015-7995","EAZEL-NAUTILUS-MS-AUG07","FOR_GNOME_0_99_1","GNOME_0_30","GNOME_PRINT_0_24","GNUMERIC_FIRST_PUBLIC_RELEASE","LIBXML2_2_4_21","LIBXML2_2_5_0","LIBXML2_2_5_10","LIBXML2_2_5_7","LIBXML2_2_5_8","LIBXML2_2_5_9","LIBXML2_2_5_x","LIBXML2_6_0","LIBXML_0_99","LIBXML_1_5_0","LIBXML_1_8_5","LIBXML_1_8_6","LIBXML_2_0_0","LIBXML_2_1_0","LIBXML_2_1_1","LIBXML_2_2_1","LIBXML_2_2_3","LIBXML_2_2_4","LIBXML_2_2_6","LIBXML_2_2_7","LIBXML_2_2_8","LIBXML_2_3_0","LIBXML_2_3_10","LIBXML_2_3_11","LIBXML_2_3_12","LIBXML_2_3_13","LIBXML_2_3_14","LIBXML_2_3_2","LIBXML_2_3_3","LIBXML_2_3_4","LIBXML_2_3_5","LIBXML_2_3_6","LIBXML_2_3_7","LIBXML_2_3_8","LIBXML_2_3_9","LIBXML_2_4_0","LIBXML_2_4_11","LIBXML_2_4_12","LIBXML_2_4_13","LIBXML_2_4_14","LIBXML_2_4_16","LIBXML_2_4_18","LIBXML_2_4_2","LIBXML_2_4_20","LIBXML_2_4_22","LIBXML_2_4_23","LIBXML_2_4_24","LIBXML_2_4_25","LIBXML_2_4_26","LIBXML_2_4_27","LIBXML_2_4_29","LIBXML_2_4_3","LIBXML_2_4_30","LIBXML_2_4_4","LIBXML_2_4_6","LIBXML_2_4_7","LIBXML_2_5_1","LIBXML_2_5_2","LIBXML_2_5_3","LIBXML_2_5_4","LIBXML_2_5_5","LIBXML_2_5_6","LIBXML_TEST_2_0_0","LIBXSLT_0_0_0","LIBXSLT_0_10_0","LIBXSLT_0_11_0","LIBXSLT_0_12_0","LIBXSLT_0_13_0","LIBXSLT_0_14_0","LIBXSLT_0_1_0","LIBXSLT_0_3_0","LIBXSLT_0_4_0","LIBXSLT_0_6_0","LIBXSLT_0_7_0","LIBXSLT_0_8_0","LIBXSLT_0_9_0","LIBXSLT_1_0_0","LIBXSLT_1_0_10","LIBXSLT_1_0_11","LIBXSLT_1_0_12","LIBXSLT_1_0_13","LIBXSLT_1_0_14","LIBXSLT_1_0_16","LIBXSLT_1_0_17","LIBXSLT_1_0_18","LIBXSLT_1_0_19","LIBXSLT_1_0_2","LIBXSLT_1_0_20","LIBXSLT_1_0_21","LIBXSLT_1_0_22","LIBXSLT_1_0_23","LIBXSLT_1_0_24","LIBXSLT_1_0_25","LIBXSLT_1_0_26","LIBXSLT_1_0_27","LIBXSLT_1_0_28","LIBXSLT_1_0_29","LIBXSLT_1_0_3","LIBXSLT_1_0_30","LIBXSLT_1_0_31","LIBXSLT_1_0_32","LIBXSLT_1_0_33","LIBXSLT_1_0_4","LIBXSLT_1_0_5","LIBXSLT_1_0_6","LIBXSLT_1_0_7","LIBXSLT_1_0_8","LIBXSLT_1_0_9","LIBXSLT_1_1_0","LIBXSLT_1_1_1","LIBXSLT_1_1_10","LIBXSLT_1_1_11","LIBXSLT_1_1_12","LIBXSLT_1_1_13","LIBXSLT_1_1_14","LIBXSLT_1_1_15","LIBXSLT_1_1_16","LIBXSLT_1_1_17","LIBXSLT_1_1_18","LIBXSLT_1_1_2","LIBXSLT_1_1_21","LIBXSLT_1_1_22","LIBXSLT_1_1_3","LIBXSLT_1_1_4","LIBXSLT_1_1_5","LIBXSLT_1_1_6","LIBXSLT_1_1_7","LIBXSLT_1_1_8","LIBXSLT_1_1_9","LIB_XML_1_1","LIB_XML_1_3","LIB_XML_1_4","LIB_XML_1_6_1","LIB_XML_1_6_2","LIB_XML_1_7_0","LIB_XML_1_7_1","LIB_XML_1_7_3","LIB_XML_1_8_3","LIB_XML_1_X","LIXSLT_0_5_0","PRE_MUCKUP","PRE_MUCKUP2","PRE_MUCKUP3","help","v1.1.25","v1.1.26","v1.1.27","v1.1.27-rc1","v1.1.28","v1.1.29","v1.1.29-rc1","v1.1.29-rc2"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"57.0.2987.75"}]},{"events":[{"introduced":"0"},{"last_affected":"57.0.2987.100"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-5029.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}