CVEvulnerability

CVE-2008-2935

7.5 HIGH Published 2008-08-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-08-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119

Description

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Affected configurations

• xmlsoft libxslt 1.1.8 • xmlsoft libxslt 1.1.9 • xmlsoft libxslt 1.1.10 • xmlsoft libxslt 1.1.11 • xmlsoft libxslt 1.1.12 • xmlsoft libxslt 1.1.13 • xmlsoft libxslt 1.1.14 • xmlsoft libxslt 1.1.15 • xmlsoft libxslt 1.1.16 • xmlsoft libxslt 1.1.17 • xmlsoft libxslt 1.1.18 • xmlsoft libxslt 1.1.19 • xmlsoft libxslt 1.1.20 • xmlsoft libxslt 1.1.21 • xmlsoft libxslt 1.1.22 • xmlsoft libxslt 1.1.23 • xmlsoft libxslt 1.1.24

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References