SUSE-SU-2017:1282-1

Advisory lineage Upstream: 4 Downstream: 0
Published: 15 May 2017, 14:44
Last modified:04 Feb 2026, 04:34

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 May 2017, 14:44
Published
Vulnerability first disclosed
04 Feb 2026, 04:34
Last Modified
Vulnerability information updated

Description

Security update for libxslt This update for libxslt fixes the following issues: - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page (bsc#1035905). - CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator could cause a heap overread. This can be exploited to leak a couple of bytes after the buffer that holds the pattern string (bsc#1005591). - CVE-2015-9019: Properly initialize random generator (bsc#934119). - CVE-2015-7995: Vulnerability in function xsltStylePreCompute' in preproc.c could cause a type confusion leading to DoS. (bsc#952474)

Affected Systems

  • suse•libxslt-python&distro=SUSE Linux Enterprise Software Development Kit 11 SP4

    < 1.1.24-19.33.3

  • suse•libxslt&distro=SUSE Linux Enterprise Server 11 SP4

    < 1.1.24-19.33.1

  • suse•libxslt&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4

    < 1.1.24-19.33.1

  • suse•libxslt&distro=SUSE Linux Enterprise Software Development Kit 11 SP4

    < 1.1.24-19.33.1

References (9)