CVE-2011-3970 — libxslt: Out-of-bounds read when parsing certain patterns

Back Back to CVE browser

MEDIUM

libxslt: Out-of-bounds read when parsing certain patterns

Published Feb 9, 2012

4.3

MEDIUM

CVSS 2.0

EPSS 1.73%

Description

libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Affected products

Red Hat Enterprise Linux 5

libxslt-0:1.1.17-4.el5_8.3

Fixed · RHSA-2012:1265
Red Hat Enterprise Linux 6

libxslt-0:1.1.26-2.el6_3.1

Fixed · RHSA-2012:1265
Red Hat Enterprise Linux 4

libxslt

Will not fix
Red Hat Enterprise Linux 6

mingw32-libxslt

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	libxslt-0:1.1.17-4.el5_8.3	Fixed	RHSA-2012:1265
Red Hat Enterprise Linux 6	libxslt-0:1.1.26-2.el6_3.1	Fixed	RHSA-2012:1265
Red Hat Enterprise Linux 4	libxslt	Will not fix	n/a
Red Hat Enterprise Linux 6	mingw32-libxslt	Will not fix	n/a

Remediation

Red Hat statement

The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw in libxslt.

Metrics

1.73% 0.01726

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01726

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.73% (0.01726)	76.71th	v5 (v2026.06.15)
Jun 15, 2026	1.85% (0.01847)	76.23th	v5 (v2026.06.15)
Mar 17, 2025	0.72% (0.00721)	70.82th	v4 (v2025.03.14)
Dec 12, 2024	0.57% (0.00575)	78.70th	v3 (v2023.03.01)
Mar 3, 2024	0.57% (0.00575)	77.42th	v3 (v2023.03.01)
Nov 8, 2023	0.57% (0.00575)	75.42th	v3 (v2023.03.01)
Sep 8, 2023	0.58% (0.00582)	75.40th	v3 (v2023.03.01)
Mar 7, 2023	0.94% (0.00941)	80.70th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 17, 2023	1.21% (0.01213)	66.22th	v2 (v2022.01.01)
Apr 1, 2022	1.21% (0.01213)	64.21th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (9)

http://code.google.com/p/chromium/issues/detail?id=110277
x_refsource_CONFIRM
http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html
x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-3970
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=788826
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-3970
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14818
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2011-3970
https://www.suse.com/support/update/announcement/2013/suse-su-20131654-1.html
vendor-advisoryx_refsource_SUSE
https://www.suse.com/support/update/announcement/2013/suse-su-20131656-1.html
vendor-advisoryx_refsource_SUSE

Link	Providers	Tags
http://code.google.com/p/chromium/issues/detail?id=110277		x_refsource_CONFIRM
http://googlechromereleases.blogspot.com/2012/02/stable-channel-update.html		x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-3970		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=788826		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-3970
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14818		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2011-3970
https://www.suse.com/support/update/announcement/2013/suse-su-20131654-1.html		vendor-advisoryx_refsource_SUSE
https://www.suse.com/support/update/announcement/2013/suse-su-20131656-1.html		vendor-advisoryx_refsource_SUSE