Read the docs
TI-2012-02444 Aliases CVE-2012-2825GHSA-fj65-38p4-j4mp

The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to…

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 11 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.

Why it matters now

EPSS 0.02196 82nd percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 11 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*up to 20.0.1132.42VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.0:*:*:*:*:*:*:*20.0.1132.0VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.1:*:*:*:*:*:*:*20.0.1132.1VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.2:*:*:*:*:*:*:*20.0.1132.2VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.3:*:*:*:*:*:*:*20.0.1132.3VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.4:*:*:*:*:*:*:*20.0.1132.4VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.5:*:*:*:*:*:*:*20.0.1132.5VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.6:*:*:*:*:*:*:*20.0.1132.6VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.7:*:*:*:*:*:*:*20.0.1132.7VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.8:*:*:*:*:*:*:*20.0.1132.8VulnerableGoogle
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* Versions up to 20.0.1132.42 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.0:*:*:*:*:*:*:* Versions 20.0.1132.0 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.1:*:*:*:*:*:*:* Versions 20.0.1132.1 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.2:*:*:*:*:*:*:* Versions 20.0.1132.2 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.3:*:*:*:*:*:*:* Versions 20.0.1132.3 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.4:*:*:*:*:*:*:* Versions 20.0.1132.4 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.5:*:*:*:*:*:*:* Versions 20.0.1132.5 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.6:*:*:*:*:*:*:* Versions 20.0.1132.6 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.7:*:*:*:*:*:*:* Versions 20.0.1132.7 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.8:*:*:*:*:*:*:* Versions 20.0.1132.8 Vulnerable ·Google
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:google:chrome:20.0.1132.9:*:*:*:*:*:*:*20.0.1132.9VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.10:*:*:*:*:*:*:*20.0.1132.10VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.11:*:*:*:*:*:*:*20.0.1132.11VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.12:*:*:*:*:*:*:*20.0.1132.12VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.13:*:*:*:*:*:*:*20.0.1132.13VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.14:*:*:*:*:*:*:*20.0.1132.14VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.15:*:*:*:*:*:*:*20.0.1132.15VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.16:*:*:*:*:*:*:*20.0.1132.16VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.17:*:*:*:*:*:*:*20.0.1132.17VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.18:*:*:*:*:*:*:*20.0.1132.18VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.19:*:*:*:*:*:*:*20.0.1132.19VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.20:*:*:*:*:*:*:*20.0.1132.20VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.21:*:*:*:*:*:*:*20.0.1132.21VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.22:*:*:*:*:*:*:*20.0.1132.22VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.23:*:*:*:*:*:*:*20.0.1132.23VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.24:*:*:*:*:*:*:*20.0.1132.24VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.25:*:*:*:*:*:*:*20.0.1132.25VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.26:*:*:*:*:*:*:*20.0.1132.26VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.27:*:*:*:*:*:*:*20.0.1132.27VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.28:*:*:*:*:*:*:*20.0.1132.28VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.29:*:*:*:*:*:*:*20.0.1132.29VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.30:*:*:*:*:*:*:*20.0.1132.30VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.31:*:*:*:*:*:*:*20.0.1132.31VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.32:*:*:*:*:*:*:*20.0.1132.32VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.33:*:*:*:*:*:*:*20.0.1132.33VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.34:*:*:*:*:*:*:*20.0.1132.34VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.35:*:*:*:*:*:*:*20.0.1132.35VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.36:*:*:*:*:*:*:*20.0.1132.36VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.37:*:*:*:*:*:*:*20.0.1132.37VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.38:*:*:*:*:*:*:*20.0.1132.38VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.39:*:*:*:*:*:*:*20.0.1132.39VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.40:*:*:*:*:*:*:*20.0.1132.40VulnerableGoogle
cpe:2.3:a:google:chrome:20.0.1132.41:*:*:*:*:*:*:*20.0.1132.41VulnerableGoogle
  • cpe:2.3:a:google:chrome:20.0.1132.9:*:*:*:*:*:*:* Versions 20.0.1132.9 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.10:*:*:*:*:*:*:* Versions 20.0.1132.10 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.11:*:*:*:*:*:*:* Versions 20.0.1132.11 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.12:*:*:*:*:*:*:* Versions 20.0.1132.12 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.13:*:*:*:*:*:*:* Versions 20.0.1132.13 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.14:*:*:*:*:*:*:* Versions 20.0.1132.14 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.15:*:*:*:*:*:*:* Versions 20.0.1132.15 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.16:*:*:*:*:*:*:* Versions 20.0.1132.16 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.17:*:*:*:*:*:*:* Versions 20.0.1132.17 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.18:*:*:*:*:*:*:* Versions 20.0.1132.18 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.19:*:*:*:*:*:*:* Versions 20.0.1132.19 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.20:*:*:*:*:*:*:* Versions 20.0.1132.20 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.21:*:*:*:*:*:*:* Versions 20.0.1132.21 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.22:*:*:*:*:*:*:* Versions 20.0.1132.22 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.23:*:*:*:*:*:*:* Versions 20.0.1132.23 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.24:*:*:*:*:*:*:* Versions 20.0.1132.24 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.25:*:*:*:*:*:*:* Versions 20.0.1132.25 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.26:*:*:*:*:*:*:* Versions 20.0.1132.26 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.27:*:*:*:*:*:*:* Versions 20.0.1132.27 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.28:*:*:*:*:*:*:* Versions 20.0.1132.28 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.29:*:*:*:*:*:*:* Versions 20.0.1132.29 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.30:*:*:*:*:*:*:* Versions 20.0.1132.30 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.31:*:*:*:*:*:*:* Versions 20.0.1132.31 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.32:*:*:*:*:*:*:* Versions 20.0.1132.32 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.33:*:*:*:*:*:*:* Versions 20.0.1132.33 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.34:*:*:*:*:*:*:* Versions 20.0.1132.34 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.35:*:*:*:*:*:*:* Versions 20.0.1132.35 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.36:*:*:*:*:*:*:* Versions 20.0.1132.36 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.37:*:*:*:*:*:*:* Versions 20.0.1132.37 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.38:*:*:*:*:*:*:* Versions 20.0.1132.38 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.39:*:*:*:*:*:*:* Versions 20.0.1132.39 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.40:*:*:*:*:*:*:* Versions 20.0.1132.40 Vulnerable ·Google
  • cpe:2.3:a:google:chrome:20.0.1132.41:*:*:*:*:*:*:* Versions 20.0.1132.41 Vulnerable ·Google

Remediation

Red Hat 1 advisory

  • RHSA-2012:1265 Released 2012-09-13 · Red Hat rating Important
    libxslt security update
    • RHEL Desktop Workstation (v. 5 client) libxslt-1.1.17-4.el5_8.3, libxslt-devel-1.1.17-4.el5_8.3, libxslt-devel-1.1.17-4.el5_8.3.i386
    • Red Hat Enterprise Linux (v. 5 server) libxslt-1.1.17-4.el5_8.3, libxslt-1.1.17-4.el5_8.3.i386, libxslt-1.1.17-4.el5_8.3.ia64 +9
    • Red Hat Enterprise Linux Desktop (v. 5 client) libxslt-1.1.17-4.el5_8.3, libxslt-1.1.17-4.el5_8.3.i386, libxslt-python-1.1.17-4.el5_8.3 +1
    • Red Hat Enterprise Linux Desktop (v. 6) libxslt-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-devel-1.1.26-2.el6_3.1, libxslt-python-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux HPC Node (v. 6) libxslt-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-devel-1.1.26-2.el6_3.1, libxslt-python-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux Server (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-1.1.26-2.el6_3.1.ppc, libxslt-devel-1.1.26-2.el6_3.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-python-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux Workstation (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-devel-1.1.26-2.el6_3.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) libxslt-1.1.26-2.el6_3.1, libxslt-python-1.1.26-2.el6_3.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix planned: Will not fix
RHEL Desktop Workstation (v. 5 client)Fixed RHSA-2012:1265
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2012:1265
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2012:1265

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2825
  2. 2026-10-03 Alias added: GHSA-fj65-38p4-j4mp

References

Advisory 5

Other 4

  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04898 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04600 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2024-04346 Use after free in Google Chrome KEVCVSS 3.1CRITICAL 9.6
  • TI-2023-05824 Integer overflow in Google Chrome KEVCVSS 3.1CRITICAL 9.6
See all 7586 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences