File _patchinfo of Package patchinfo.4410

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.4410

<patchinfo incident="4410">
  <issue id="1005591" tracker="bnc">VUL-1: CVE-2016-4738: libxslt: Possible heap overread</issue>
  <issue id="934119" tracker="bnc">VUL-1: CVE-2015-9019: libxslt: math.random() in xslt uses unseeded randomness</issue>
  <issue id="1035905" tracker="bnc">VUL-1: CVE-2017-5029: libxslt: integer overflow during a size calculation (xsltAddTextString function in transform.c)</issue>
  <issue id="952474" tracker="bnc">VUL-1: CVE-2015-7995 libxslt: Type confusion DoS</issue>
  <issue id="2015-9019" tracker="cve" />
   <issue id="2017-5029" tracker="cve" />
  <issue id="2015-7995" tracker="cve" />
   <issue id="2016-4738" tracker="cve" />
   <category>security</category>
  <rating>moderate</rating>
   <packager>pmonrealgonzalez</packager>
   <description>
 This update for libxslt fixes the following issues:

- CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check 
for integer overflow during a size calculation, which allowed a remote attacker 
to perform an out of bounds memory write via a crafted HTML page (bsc#1035905).

- CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator 
could cause a heap overread. This can be exploited to leak a couple of bytes after 
the buffer that holds the pattern string (bsc#1005591).

- CVE-2015-9019: Properly initialize random generator (bsc#934119).

- CVE-2015-7995: Vulnerability in function xsltStylePreCompute" in preproc.c could cause a 
type confusion leading to DoS. (bsc#952474)

</description>
   <summary>Security update for libxslt</summary>
 </patchinfo>

Places

File _patchinfo of Package patchinfo.4410

Places