CVE-2017-5029

What it actually does

Integer overflow in xsltAddTextString during size calculation in libxslt 1.1.29 allows out-of-bounds memory write when processing crafted XSLT in HTML.

Why it matters to the business

Remote attackers could achieve code execution or denial of service in applications using the affected dagger packages, though the vulnerability is over seven years old with minimal modern exposure.

How an attack unfolds

An attacker sends a victim a crafted HTML page containing malicious XSLT; when the browser renders it, the missing overflow check in libxslt's transform logic corrupts memory and can lead to arbitrary code execution within the renderer process.

How to fix it

Upgrade dagger (Chainguard) to 0.10.1-r1 or later and dagger (Wolfi) to 0.10.1-r1 or later to obtain the patched libxslt.

How to confirm the fix worked

Confirm installed package versions meet or exceed the fixed releases; re-test rendering of known trigger HTML after upgrade.

Typical attack path

1. Craft malicious HTML containing XSLT that triggers integer overflow in xsltAddTextString
2. Host the page on an attacker-controlled site or deliver via phishing
3. Victim browser loads and processes the page using vulnerable libxslt
4. Overflow during size calculation writes beyond allocated buffer
5. Corrupted memory enables control-flow hijacking or crash

How to detect it

Review web server and browser process logs for crashes during XSLT handling; search historical telemetry for requests containing unusual XSLT patterns that match the 2017-era trigger.

What your security team should do

• Apply the specified package upgrades across all environments
• Audit dependency trees for any remaining direct use of libxslt 1.1.29
• Disable XSLT processing for untrusted content where feasible