VulnerabilityModified
CVE-2015-7995
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.
MEDIUM 5.0EPSS 4.24%
Does this matter?
Lower severity and a low EPSS score (4.24%). Track it; it rarely justifies an emergency change on its own.
Description
The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 4.24% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- apple/iphone os · apple/mac os x · apple/tvos · apple/watchos · xmlsoft/libxslt
- Source
- cve@mitre.org
References
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html
- http://www.debian.org/security/2016/dsa-3605
- http://www.openwall.com/lists/oss-security/2015/10/27/10
- http://www.openwall.com/lists/oss-security/2015/10/28/4
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- http://www.securityfocus.com/bid/77325
- http://www.securitytracker.com/id/1034736
- http://www.securitytracker.com/id/1038623
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546
- https://bugzilla.redhat.com/show_bug.cgi?id=1257962Exploit
- https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- https://puppet.com/security/cve/cve-2015-7995
- https://support.apple.com/HT205729
- https://support.apple.com/HT205731
- https://support.apple.com/HT205732
- https://support.apple.com/HT206168Vendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html
- http://www.debian.org/security/2016/dsa-3605
- http://www.openwall.com/lists/oss-security/2015/10/27/10
- http://www.openwall.com/lists/oss-security/2015/10/28/4
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.