Arch Linux Security Advisory ASA-201703-5 ========================================= Severity: Critical Date : 2017-03-12 CVE-ID : CVE-2017-5029 Package : libxslt Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-195 Summary ======= The package libxslt before version 1.1.29+41+gdf5330d1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.29+41+gdf5330d1-1. # pacman -Syu "libxslt>=1.1.29+41+gdf5330d1-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An integer overflow issue has been found in libxslt, leading to an out of bounds write on 64-bit systems. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/53257 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desk... https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df7... https://crbug.com/676623 https://security.archlinux.org/CVE-2017-5029