ECHO-6324-537e-5d75

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-6324-537e-5d75.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-6324-537e-5d75
Upstream
  • GHSA-8xxg-m548-vx69
Withdrawn
2025-08-03T16:59:07Z
Published
2025-09-15T01:08:50Z
Modified
2026-09-15T03:42:50Z
Summary
According to the upstream, math.random() is not intended to meet cryptographic randomness requirements. Proper seeding should be handled by the application using libxslt. Additionally, calling srand() from a library is considered bad practice, as applications may expect deterministic behavior from random(). https://security-tracker.debian.org/tracker/CVE-2015-9019
Details
References

Affected packages

Echo / libxslt

Package

Name
libxslt
Purl
pkg:deb/echo/libxslt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1.35-1+deb12u1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-6324-537e-5d75.json"