CVE-2015-7995

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.

La función xsltStylePreCompute en preproc.c en libxslt 1.1.28 no comprueba si el nodo padre es un elemento, lo que permite a atacantes causar una denegación de servicio a través de un archivo XML manipulado, relacionado a un problema 'type confusion'.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-10-28 CVE Reserved
2015-11-17 CVE Published
2023-04-29 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (22)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2015/10/27/10	Mailing List
http://www.openwall.com/lists/oss-security/2015/10/28/4	Mailing List
http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html	X_refsource_confirm
http://www.securityfocus.com/bid/77325	Vdb Entry
http://www.securitytracker.com/id/1034736	Vdb Entry
http://www.securitytracker.com/id/1038623	Vdb Entry
https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617	X_refsource_confirm
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017	X_refsource_confirm
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380	X_refsource_confirm
https://puppet.com/security/cve/cve-2015-7995	X_refsource_confirm
https://support.apple.com/HT205729	X_refsource_confirm
https://support.apple.com/HT205731	X_refsource_confirm
https://support.apple.com/HT205732	X_refsource_confirm

URL	Date	SRC
https://bugzilla.redhat.com/show_bug.cgi?id=1257962	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html	2019-03-08
http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html	2019-03-08
http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html	2019-03-08
http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html	2019-03-08
http://lists.opensuse.org/opensuse-updates/2016-05/msg00123.html	2019-03-08
http://www.debian.org/security/2016/dsa-3605	2019-03-08
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546	2019-03-08
https://support.apple.com/HT206168	2019-03-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apple Search vendor "Apple"		Iphone Os Search vendor "Apple" for product "Iphone Os"				<= 9.2 Search vendor "Apple" for product "Iphone Os" and version " <= 9.2"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				<= 10.11.2 Search vendor "Apple" for product "Mac Os X" and version " <= 10.11.2"		-		Affected
Apple Search vendor "Apple"		Tvos Search vendor "Apple" for product "Tvos"				<= 9.1 Search vendor "Apple" for product "Tvos" and version " <= 9.1"		-		Affected
Apple Search vendor "Apple"		Watchos Search vendor "Apple" for product "Watchos"				<= 2.1 Search vendor "Apple" for product "Watchos" and version " <= 2.1"		-		Affected
Xmlsoft Search vendor "Xmlsoft"		Libxslt Search vendor "Xmlsoft" for product "Libxslt"				<= 1.1.28 Search vendor "Xmlsoft" for product "Libxslt" and version " <= 1.1.28"		-		Affected