CVE-2015-7995

Public Exploit

Description

The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.46% Top 25%

Vendor Advisory debian.org Vendor Advisory apple.com Vendor Advisory apple.com Vendor Advisory apple.com Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory slackware.com Vendor Advisory apple.com

Affected: n/a n/a

References

Link	Tags
http://www.debian.org/security/2016/dsa-3605	vendor advisory
https://support.apple.com/HT206168	vendor advisory
https://support.apple.com/HT205731
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
https://support.apple.com/HT205729
http://www.openwall.com/lists/oss-security/2015/10/27/10	mailing list
http://www.openwall.com/lists/oss-security/2015/10/28/4	mailing list
http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html	vendor advisory
http://www.securitytracker.com/id/1034736	vdb entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html	vendor advisory
http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	vendor advisory
https://puppet.com/security/cve/cve-2015-7995
http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html	vendor advisory
https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617
http://www.securityfocus.com/bid/77325	vdb entry
http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html	vendor advisory
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546	vendor advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
https://support.apple.com/HT205732
https://bugzilla.redhat.com/show_bug.cgi?id=1257962	exploit
http://www.securitytracker.com/id/1038623	vdb entry

Frequently Asked Questions

What is the severity of CVE-2015-7995?: CVE-2015-7995 has been scored as a medium severity vulnerability.
How to fix CVE-2015-7995?: To fix CVE-2015-7995, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2015-7995 being actively exploited in the wild?: It is possible that CVE-2015-7995 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.