{"id":"CVE-2015-9019","aliases":["DEBIAN-CVE-2015-9019","EUVD-2015-8873","GHSA-8xxg-m548-vx69","MGASA-2017-0169","ROOT-OS-DEBIAN-12-CVE-2015-9019","SUSE-SU-2017:1282-1","SUSE-SU-2017:1313-1","UBUNTU-CVE-2015-9019","openSUSE-SU-2024:11017-1"],"status":"published","title":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random...","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02423,"percentile":0.84296,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2017-04-05T21:00:00Z","modified":"2026-10-09T07:15:11Z","fixes":[{"ecosystem":"Mageia:5","package":"libxslt","fixed_in":["1.1.29-1.3.mga5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"libxslt","fixed_in":["1.1.35-1+deb12u4.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libxslt","fixed_in":["1.1.35-1+deb12u4.aikido.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.35-1","1.1.35-1+deb12u1","1.1.35-1+deb12u2","1.1.35-1+deb12u3","1.1.35-1+deb12u4","1.1.35-1.1","1.1.35-1.2","1.1.35-2","1.1.39-0exp1","1.1.43-0.1","1.1.43-0.2","1.1.43-0.3","1.1.43-0exp1","1.1.45-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.35-1.2","1.1.35-1.2+deb13u1","1.1.35-1.2+deb13u2","1.1.35-1.2+deb13u3","1.1.35-2","1.1.39-0exp1","1.1.43-0.1","1.1.43-0.2","1.1.43-0.3","1.1.43-0exp1","1.1.45-0.1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.35-1.2","1.1.35-2","1.1.39-0exp1","1.1.43-0.1","1.1.43-0.2","1.1.43-0.3","1.1.43-0exp1","1.1.45-0.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.29-1.3.mga5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.35-1+deb12u4.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.35-1+deb12u4.aikido.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.24-19.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"libxslt-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.24-19.33.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.24-19.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.24-19.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.28-16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.28-2","1.1.28-2build1","1.1.28-2ubuntu0.1","1.1.28-2ubuntu0.2","1.1.28-2ubuntu0.2+esm1","1.1.28-2ubuntu0.2+esm2","1.1.28-2ubuntu0.2+esm3","1.1.28-2ubuntu0.2+esm4","1.1.28-2ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.28-2build2","1.1.28-2.1","1.1.28-2.1ubuntu0.1","1.1.28-2.1ubuntu0.2","1.1.28-2.1ubuntu0.3","1.1.28-2.1ubuntu0.3+esm1","1.1.28-2.1ubuntu0.3+esm2","1.1.28-2.1ubuntu0.3+esm3","1.1.28-2.1ubuntu0.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.29-2.1ubuntu1","1.1.29-4","1.1.29-5","1.1.29-5ubuntu0.1","1.1.29-5ubuntu0.2","1.1.29-5ubuntu0.3","1.1.29-5ubuntu0.3+esm1","1.1.29-5ubuntu0.3+esm2","1.1.29-5ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.33-0ubuntu1","1.1.33-0ubuntu2","1.1.33-0ubuntu3","1.1.34-1","1.1.34-1ubuntu1","1.1.34-3","1.1.34-4","1.1.34-4ubuntu0.20.04.1","1.1.34-4ubuntu0.20.04.2","1.1.34-4ubuntu0.20.04.3","1.1.34-4ubuntu0.20.04.3+esm1","1.1.34-4ubuntu0.20.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.34-4","1.1.34-4build1","1.1.34-4build2","1.1.34-4ubuntu0.22.04.1","1.1.34-4ubuntu0.22.04.2","1.1.34-4ubuntu0.22.04.3","1.1.34-4ubuntu0.22.04.4","1.1.34-4ubuntu0.22.04.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxslt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.34-3.2"}]}],"bundled":8}],"products":[{"vendor":"xmlsoft","product":"libxslt"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=934119","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","advisory","fix","report"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=758400","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-9019"},{"url":"https://github.com/advisories/GHSA-8xxg-m548-vx69"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-9019","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0169.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20921","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-05/msg00079.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171282-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005591","tags":["report"]},{"url":"https://bugzilla.suse.com/1035905","tags":["report"]},{"url":"https://bugzilla.suse.com/934119","tags":["report"]},{"url":"https://bugzilla.suse.com/952474","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-9019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171313-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-9019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-9019","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18197","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-9019","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:00:00Z","modified":"2024-09-16T22:56:40.583Z","updated_at":"2026-11-02T14:35:40.591596Z"}],"euvd":[{"id":"EUVD-2015-8873","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:00:00Z","modified":"2024-09-16T22:56:40Z","updated_at":"2026-11-03T00:54:58.273879Z"}],"ghsa":[{"id":"GHSA-8xxg-m548-vx69","title":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random...","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2022-05-17T02:50:38Z","modified":"2023-01-27T05:06:15Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:42:52.308172Z"}],"nvd":[{"id":"CVE-2015-9019","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:59:00.147Z","modified":"2026-06-17T00:35:40.667Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"CVE-2015-9019","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:59:00Z","modified":"2026-04-16T06:17:33.775942193Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-9019","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:59:00.147Z","modified":"2026-09-09T07:01:48.408767315Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2015-9019","description":"In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.","status":"published","published":"2017-04-05T21:59:00Z","modified":"2026-04-22T10:24:46.101945Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"MGASA-2017-0169","title":"Updated libxslt packages fix security vulnerability","description":"The libxslt library failed to seed its random number generator,\nresulting in predictable random values (CVE-2015-9019).\n","status":"published","published":"2017-06-12T07:42:23Z","modified":"2026-04-16T06:23:57.950005303Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11017-1","title":"libxslt-devel-1.1.34-3.2 on GA media","description":"These are all security issues fixed in the libxslt-devel-1.1.34-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:26.029331Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2015-9019","title":"CVE-2015-9019 in libxslt - Patched by Root","description":"Root has patched CVE-2015-9019 in the libxslt package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-09T06:13:56Z","modified":"2026-10-09T07:15:11.368802668Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"SUSE-SU-2017:1282-1","title":"Security update for libxslt","description":"\n This update for libxslt fixes the following issues:\n \n- CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check \nfor integer overflow during a size calculation, which allowed a remote attacker \nto perform an out of bounds memory write via a crafted HTML page (bsc#1035905).\n\n- CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator \ncould cause a heap overread. This can be exploited to leak a couple of bytes after \nthe buffer that holds the pattern string (bsc#1005591).\n\n- CVE-2015-9019: Properly initialize random generator (bsc#934119).\n\n- CVE-2015-7995: Vulnerability in function xsltStylePreCompute' in preproc.c could cause a \ntype confusion leading to DoS. (bsc#952474)\n\n ","status":"published","published":"2017-05-15T14:44:26Z","modified":"2026-02-04T04:34:58.180943Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1313-1","title":"Security update for libxslt","description":"\n This update for libxslt fixes the following issues:\n \n\n- CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check \nfor integer overflow during a size calculation, which allowed a remote attacker \nto perform an out of bounds memory write via a crafted HTML page (bsc#1035905).\n\n- CVE-2016-4738: Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator \ncould cause a heap overread. This can be exploited to leak a couple of bytes after \nthe buffer that holds the pattern string (bsc#1005591).\n\n- CVE-2015-9019: Properly initialize random generator (bsc#934119).\n\n- CVE-2015-7995: Vulnerability in function xsltStylePreCompute' in preproc.c could cause a \ntype confusion leading to DoS. (bsc#952474)\n\n ","status":"published","published":"2017-05-16T13:41:07Z","modified":"2026-02-04T03:20:17.280197Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}