CVE-2015-9019
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random...
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
CVE-2015-9019- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
CVE List No score
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
CVE-2015-9019- Updated
- 2026-11-02
EUVDEUVD-2015-8873 No score
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
EUVD-2015-8873- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8xxg-m548-vx69
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random...
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
GHSA-8xxg-m548-vx69- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
CVE-2015-9019- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-9019
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
DEBIAN-CVE-2015-9019- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2015-9019
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
- Record
UBUNTU-CVE-2015-9019- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0169 No score
Updated libxslt packages fix security vulnerability
The libxslt library failed to seed its random number generator, resulting in predictable random values (CVE-2015-9019).
- Record
MGASA-2017-0169- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11017-1 No score
libxslt-devel-1.1.34-3.2 on GA media
These are all security issues fixed in the libxslt-devel-1.1.34-3.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11017-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2015-9019 No score
CVE-2015-9019 in libxslt - Patched by Root
Root has patched CVE-2015-9019 in the libxslt package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2015-9019- Updated
- 2026-11-02
OSVSUSE-SU-2017:1282-1 No score
Security update for libxslt
This update for libxslt fixes the following issues:
-
CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page (bsc#1035905).
-
CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator could cause a heap overread. This can be exploited to leak a couple of bytes after the buffer that holds the pattern string (bsc#1005591).
-
CVE-2015-9019: Properly initialize random generator (bsc#934119).
-
CVE-2015-7995: Vulnerability in function xsltStylePreCompute' in preproc.c could cause a type confusion leading to DoS. (bsc#952474)
- Record
SUSE-SU-2017:1282-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:1313-1 No score
Security update for libxslt
This update for libxslt fixes the following issues:
-
CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page (bsc#1035905).
-
CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator could cause a heap overread. This can be exploited to leak a couple of bytes after the buffer that holds the pattern string (bsc#1005591).
-
CVE-2015-9019: Properly initialize random generator (bsc#934119).
-
CVE-2015-7995: Vulnerability in function xsltStylePreCompute' in preproc.c could cause a type confusion leading to DoS. (bsc#952474)
- Record
SUSE-SU-2017:1313-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxsltDebian:12 |
All versions, plus listed versions 1.1.35-11.1.35-1+deb12u11.1.35-1+deb12u21.1.35-1+deb12u31.1.35-1+deb12u4 Show 9 moreShow less1.1.35-1.11.1.35-1.21.1.35-21.1.39-0exp11.1.43-0.11.1.43-0.21.1.43-0.31.1.43-0exp11.1.45-0.1 |
None known |
libxsltDebian:13 |
All versions, plus listed versions 1.1.35-1.21.1.35-1.2+deb13u11.1.35-1.2+deb13u21.1.35-1.2+deb13u31.1.35-2 Show 6 moreShow less1.1.39-0exp11.1.43-0.11.1.43-0.21.1.43-0.31.1.43-0exp11.1.45-0.1 |
None known |
libxsltDebian:14 |
All versions, plus listed versions 1.1.35-1.21.1.35-21.1.39-0exp11.1.43-0.11.1.43-0.21.1.43-0.31.1.43-0exp11.1.45-0.1 |
None known |
libxsltMageia:5 |
before 1.1.29-1.3.mga5 | 1.1.29-1.3.mga5 |
libxsltRoot:Debian:12 |
before 1.1.35-1+deb12u4.aikido.13 | 1.1.35-1+deb12u4.aikido.13 |
rootio-libxsltRoot:Debian:12 |
before 1.1.35-1+deb12u4.aikido.13 | 1.1.35-1+deb12u4.aikido.13 |
libxsltSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.1.24-19.33.1 | 1.1.24-19.33.1 |
libxslt-pythonSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.1.24-19.33.3 | 1.1.24-19.33.3 |
libxsltSUSE:Linux Enterprise Server 11 SP4 |
before 1.1.24-19.33.1 | 1.1.24-19.33.1 |
libxsltSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.1.24-19.33.1 | 1.1.24-19.33.1 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxsltSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Desktop 12 SP2 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Server 12 SP1 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Server 12 SP2 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.1.28-16.1 | 1.1.28-16.1 |
libxsltUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1.28-21.1.28-2build11.1.28-2ubuntu0.11.1.28-2ubuntu0.21.1.28-2ubuntu0.2+esm1 Show 4 moreShow less1.1.28-2ubuntu0.2+esm21.1.28-2ubuntu0.2+esm31.1.28-2ubuntu0.2+esm41.1.28-2ubuntu0.2+esm5 |
None known |
libxsltUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.1.28-2build21.1.28-2.11.1.28-2.1ubuntu0.11.1.28-2.1ubuntu0.21.1.28-2.1ubuntu0.3 Show 4 moreShow less1.1.28-2.1ubuntu0.3+esm11.1.28-2.1ubuntu0.3+esm21.1.28-2.1ubuntu0.3+esm31.1.28-2.1ubuntu0.3+esm4 |
None known |
libxsltUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.29-2.1ubuntu11.1.29-41.1.29-51.1.29-5ubuntu0.11.1.29-5ubuntu0.2 Show 4 moreShow less1.1.29-5ubuntu0.31.1.29-5ubuntu0.3+esm11.1.29-5ubuntu0.3+esm21.1.29-5ubuntu0.3+esm3 |
None known |
libxsltUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.33-0ubuntu11.1.33-0ubuntu21.1.33-0ubuntu31.1.34-11.1.34-1ubuntu1 Show 7 moreShow less1.1.34-31.1.34-41.1.34-4ubuntu0.20.04.11.1.34-4ubuntu0.20.04.21.1.34-4ubuntu0.20.04.31.1.34-4ubuntu0.20.04.3+esm11.1.34-4ubuntu0.20.04.3+esm2 |
None known |
libxsltUbuntu:22.04:LTS |
All versions, plus listed versions 1.1.34-41.1.34-4build11.1.34-4build21.1.34-4ubuntu0.22.04.11.1.34-4ubuntu0.22.04.21.1.34-4ubuntu0.22.04.31.1.34-4ubuntu0.22.04.41.1.34-4ubuntu0.22.04.5 |
None known |
libxsltopenSUSE:Tumbleweed |
before 1.1.34-3.2 | 1.1.34-3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-9019 is a medium vulnerability (CVSS 5.3) in Xmlsoft Libxslt, published April 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in libxslt 1.1.29-1.3.mga5.
References
bugzilla.suse.com/show_bug.cgi?id=934119
bugzilla.gnome.org/show_bug.cgi?id=758400
nvd.nist.gov/vuln/detail/CVE-2015-9019
github.com/advisories/GHSA-8xxg-m548-vx69
security-tracker.debian.org/tracker/CVE-2015-9019
advisories.mageia.org/MGASA-2017-0169.html
Show 19 moreShow less
bugs.mageia.org/show_bug.cgi?id=20921
lists.opensuse.org/opensuse-updates/2017-05/msg00079.html
suse.com/support/update/announcement/2017/suse-su-20171282-1
ubuntu.com/security/CVE-2015-9019
cve.org/CVERecord?id=CVE-2015-9019