CVE-2008-2935
- State
- Published
- Severity
- Not scored
- Published
- Aug 1, 2008
- Updated
- Aug 7, 2024
- Reserved
- Jun 30, 2008
Description
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2008:0649vendor-advisory
- oval:org.mitre.oval:def:10827vdb-entrysignature
- libxslt-multiple-crypto-bo(44141)vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0306
- 32453third-party-advisory
- 31399third-party-advisory
- 31363third-party-advisory
- http://www.scary.beasts.org/security/CESA-2008-003.html
- FEDORA-2008-7029vendor-advisory
- 20080731 [oCERT-2008-009] libxslt heap overflowmailing-list
- 30467vdb-entry
- http://www.ocert.org/patches/exslt_crypt.patch
- 4078third-party-advisory
- GLSA-200808-06vendor-advisory
- 31310third-party-advisory
- MDVSA-2008:160vendor-advisory
- USN-633-1vendor-advisory
- 31331third-party-advisory
- 20081027 rPSA-2008-0306-1 libxsltmailing-list
- 20080801 libxslt heap overflowmailing-list
- 31230third-party-advisory
- FEDORA-2008-7062vendor-advisory
- ADV-2008-2266vdb-entry
- 1020596vdb-entry
- DSA-1624vendor-advisory
- 31395third-party-advisory
- http://www.ocert.org/advisories/ocert-2008-009.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.