CVE-2015-7995

What it actually does

The xsltStylePreCompute function in preproc.c fails to verify that the parent node is an element node before processing, enabling type confusion that crashes the parser when a crafted XML input is supplied.

Why it matters to the business

Systems that process untrusted XML via affected libxslt-dependent components can be remotely crashed, causing service outages and requiring restarts on legacy or unpatched installations.

How an attack unfolds

An attacker creates an XML document that exercises the missing parent-node check in xsltStylePreCompute, then supplies the file to any application using the vulnerable libxslt code path; the type confusion immediately triggers a denial-of-service crash.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 25.0.0.171ubuntu0.14.04.1 or newer; apply any subsequent libxslt updates that correct the preproc.c check.

How to confirm the fix worked

Confirm the installed package version is at or above the listed fixed release; reprocess known-good and crafted test XML files to verify absence of crashes.

Typical attack path

1. Craft malicious XML that triggers non-element parent in xsltStylePreCompute
2. Deliver the XML through any input channel accepted by the vulnerable application
3. Trigger XSLT preprocessing
4. Induce crash via type confusion

How to detect it

Review application and system logs for sudden crashes or segmentation faults during XML or XSLT processing; correlate with inbound XML payloads from untrusted origins.

What your security team should do

• Apply the specified package update on all affected Ubuntu 14.04 systems
• Disable XML/XSLT processing from untrusted sources until patched
• Monitor application crash logs for repeated libxslt failures