CVE:CVE-2011-1425
CNNVD:CNNVD-201104-019
XML Security Library是一个基于LibXML2 开发的用来处理XML安全标准的C库。
当XSLT启用时，在WebKit和其他产品中使用的XML Security Library（又名xmlsec）1.2.17之前版本中的xslt.c中存在权限许可和访问控制漏洞。远程攻击者可以借助与签名验证过程中的libxslt输出扩展和ds:Transform元素有关的向量，创建或者覆盖任意文件。
solution:Upgrade aleksey xml_security_library to a higher version than 1.2.16,0.0.1,0.0.2,0.0.2a,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.1.0,0.1.1,1.0.0,1.0.0:rc1,1.0.1,1.0.2,1.0.3,1.0.4,1.1.0,1.1.1,1.1.2,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.2.7,1.2.8,1.2.9,1.2.10,1.2.11,1.2.13,1.2.14,1.2.15,and avoid the version (,1.2.16],0.0.1,0.0.2,0.0.2a,0.0.3,0.0.4,0.0.5,0.0.6,0.0.7,0.0.8,0.0.9,0.0.10,0.0.11,0.0.12,0.0.13,0.0.14,0.0.15,0.1.0,0.1.1,1.0.0,1.0.0:rc1,1.0.1,1.0.2,1.0.3,1.0.4,1.1.0,1.1.1,1.1.2,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.2.7,1.2.8,1.2.9,1.2.10,1.2.11,1.2.13,1.2.14,1.2.15; Upgrade apple webkit to a higher version than *