CVE-2015-7995: apple iphone_os

Modified

AliasesMGASA-2015-0432UBUNTU-CVE-2015-7995DEBIAN-CVE-2015-7995+1 more

Published 17-11-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-7995 is a medium (CVSS 5.0) vulnerability in apple iphone_os. EPSS estimates a 4.27% chance of exploitation in the next 30 days, higher than 91.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

4.27%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 11 · Related 9

DLA-514-1 DSA-3605-1 OPENSUSE-SU-2024:10549-1 OPENSUSE-SU-2024:11912-1 OPENSUSE-SU-2024:13165-1 OPENSUSE-SU-2024:14174-1+5 more

Timeline

17-11-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to cause a denial of service via a crafted XML file, related to a "type confusion" issue.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

4.27%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 4.24% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apple4 products

iphone_os≤ 9.2
mac_os_x≤ 10.11.2
tvos≤ 9.1
watchos≤ 2.1

Debian1 product

libxslt< 1.1.28-2.1

Mageia1 product

libxslt< 1.1.28-8.1.mga5

Opensuse1 product

libxslt&distro=openSUSE Tumbleweed< 1.1.29-1.3

Ubuntu1 product

libxslt< 1.1.28-2ubuntu0.1

Xmlsoft1 product

libxslt≤ 1.1.28

6 vendors · 9 products

References

30 links

www.debian.org/security/2016/dsa-3605Vendor AdvisoryX Refsource DEBIAN
support.apple.com/HT206168X Refsource CONFIRMVendor Advisory
support.apple.com/HT205731X Refsource CONFIRM
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017X Refsource CONFIRM
support.apple.com/HT205729X Refsource CONFIRM
www.openwall.com/lists/oss-security/2015/10/27/10Mailing ListX Refsource MLISTREPORT
www.openwall.com/lists/oss-security/2015/10/28/4Mailing ListX Refsource MLIST
lists.apple.com/archives/security-announce/2016/Jan/msg00005.htmlVendor AdvisoryX Refsource APPLE
www.securitytracker.com/id/1034736VDB EntryX Refsource SECTRACK
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380X Refsource CONFIRM

Show all 30 references

lists.apple.com/archives/security-announce/2016/Jan/msg00003.htmlVendor AdvisoryX Refsource APPLE
lists.apple.com/archives/security-announce/2016/Mar/msg00001.htmlVendor AdvisoryX Refsource APPLE
puppet.com/security/cve/cve-2015-7995X Refsource CONFIRM
lists.apple.com/archives/security-announce/2016/Jan/msg00002.htmlVendor AdvisoryX Refsource APPLE
git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617X Refsource CONFIRM
www.securityfocus.com/bid/77325VDB EntryX Refsource BID
lists.opensuse.org/opensuse-updates/2016-05/msg00123.htmlVendor AdvisoryX Refsource SUSE
www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.386546Vendor AdvisoryX Refsource SLACKWARE
www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.htmlX Refsource CONFIRM
support.apple.com/HT205732X Refsource CONFIRM
bugzilla.redhat.com/show_bug.cgi?id=1257962X Refsource CONFIRMExploit
www.securitytracker.com/id/1038623VDB EntryX Refsource SECTRACK
advisories.mageia.org/MGASA-2015-0432.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=17040REPORT
openwall.com/lists/oss-security/2015/10/28/4WEB
ubuntu.com/security/CVE-2015-7995REPORT
ubuntu.com/security/notices/USN-3271-1Advisory
www.cve.org/CVERecord?id=CVE-2015-7995REPORT
security-tracker.debian.org/tracker/CVE-2015-7995Advisory
www.suse.com/security/cve/CVE-2015-7995WEB