Arch Linux Security Advisory ASA-201601-8 ========================================= Severity: Medium Date : 2016-01-13 CVE-ID : CVE-2015-7995 Package : libxslt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libxslt before version 1.1.28-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.28-4. # pacman -Syu "libxslt>=1.1.28-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A type confusion vulnerability was discovered in the xsltStylePreCompute() function of libxslt. A remote attacker could possibly exploit this flaw to cause an application using libxslt to crash by tricking the application into processing a specially crafted XSLT document. Impact ====== A remote attacker is able to create a specially crafted XSLT document that, when processed, is leading to an application crash resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-7995 https://git.gnome.org/browse/libxslt/commit/?id=7ca19df89 https://bugzilla.redhat.com/show_bug.cgi?id=1257962 https://bugs.archlinux.org/task/47681