CVE-2012-2870 Denial of service in n/a

What is CVE-2012-2870?

CVE-2012-2870 is a medium-severity denial of service vulnerability in Apple Iphone Os, published on 31 Aug 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.

Weakness: CWE-399

Which versions are affected by CVE-2012-2870?

It affects 3 products.

Products include Apple Iphone Os, Google Chrome, Xmlsoft Libxslt.

How do I fix CVE-2012-2870?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-2870 being exploited?

There is no known exploitation of CVE-2012-2870 in the wild and no public exploit code.

Other vulnerabilities in Apple Iphone Os

• CVE-2021-30666 Apple iOS WebKit Buffer Overflow Exploited High 8.8
• CVE-2021-30761 Apple iOS WebKit Memory Corruption Exploited High 8.8
• CVE-2021-30762 Apple iOS WebKit Use-After-Free Exploited High 8.8
• CVE-2016-4657 Apple iOS Webkit Memory Corruption Exploited High 8.8
• CVE-2019-7286 Apple Multiple Products Memory Corruption Exploited High 7.8

All Apple Iphone Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-2870, GHSA-3g6j-g63v-rg6h.