[Bug 210298] textproc/libxslt: Update to 1.1.29

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=210298

--- Comment #5 from Vladimir Krstulja <vlad-fbsd at acheronmedia.com> ---
Two new CVEs are apparently fixed in 1.1.29:

* CVE-2016-1683
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1683

  numbers.c in libxslt before 1.1.29, as used in Google Chrome before
51.0.2704.63, mishandles namespace nodes, which allows remote attackers to
cause a denial of service (out-of-bounds heap memory access) or possibly have
unspecified other impact via a crafted document.

* CVE-2016-1684
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1684
 
https://git.gnome.org/browse/libxslt/commit/libxslt/numbers.c?id=91d0540ac9beaa86719a05b749219a69baa0dd8d 

  numbers.c in libxslt before 1.1.29, as used in Google Chrome before
51.0.2704.63, mishandles the i format token for xsl:number data, which allows
remote attackers to cause a denial of service (integer overflow or resource
consumption) or possibly have unspecified other impact via a crafted document.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.