Predictable Output in Libxslt Math Function Impacting Users
CVE-2015-9019

5.3MEDIUM

Key Information:

Vendor

Xmlsoft

Status
Libxslt
Vendor
CVE Published:
5 April 2017

What is CVE-2015-9019?

In libxslt versions prior to 1.1.30, the EXSLT math.random function lacked proper initialization, resulting in predictable outputs. This flaw poses a risk as the function can be leveraged in applications requiring randomization, potentially leading to security issues due to the lack of randomness in generated values. Users and developers relying on this library must ensure they are using an updated version to mitigate potential risks.

References

https://bugzilla.suse.com/show_bug.cgi?id=934119
x_refsource_MISC
https://bugzilla.gnome.org/show_bug.cgi?id=758400
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.