libxslt in Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.