CVE-2017-5029: Upstream libxslt vulnerabilities

April 24, 2017 (updated January 5, 2018)

The xsltAddTextString function in transform.c in libxslt, as used by nokogiri, lacks a check for integer overflow during a size calculation, which allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page.

References

www.securityfocus.com/bid/96767
crbug.com/676623
github.com/sparklemotion/nokogiri/issues/1634
nvd.nist.gov/vuln/detail/CVE-2017-5029

Code Behaviors & Features

Detect and mitigate CVE-2017-5029 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →