CVE-2015-7995

Publication date 17 November 2015

Last updated 24 July 2024

The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libxslt	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Ignored end of life
	15.04 vivid	Ignored end of life
	14.04 LTS trusty	Fixed 1.1.28-2ubuntu0.1
	12.04 LTS precise	Fixed 1.1.26-8ubuntu1.4

How can I get the fixes?
What do statuses mean?
Patch details

Notes

sbeattie

reproducer in Red Hat bug

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libxslt	Upstream: ?id=7ca

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-3271-1
Libxslt vulnerabilities
28 April 2017

Other references

http://www.openwall.com/lists/oss-security/2015/10/27/10
https://www.cve.org/CVERecord?id=CVE-2015-7995