CVE-2008-2935 Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1...
HighCVSS 7.5
EPSS 12.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmlsoft libxslt | = 1.1.8 | No fix listed |
| xmlsoft libxslt | = 1.1.9 | No fix listed |
| xmlsoft libxslt | = 1.1.10 | No fix listed |
| xmlsoft libxslt | = 1.1.11 | No fix listed |
| xmlsoft libxslt | = 1.1.12 | No fix listed |
| xmlsoft libxslt | = 1.1.13 | No fix listed |
| xmlsoft libxslt | = 1.1.14 | No fix listed |
| xmlsoft libxslt | = 1.1.15 | No fix listed |
| xmlsoft libxslt | = 1.1.16 | No fix listed |
| xmlsoft libxslt | = 1.1.17 | No fix listed |
| xmlsoft libxslt | = 1.1.18 | No fix listed |
| xmlsoft libxslt | = 1.1.19 | No fix listed |
| xmlsoft libxslt | = 1.1.20 | No fix listed |
| xmlsoft libxslt | = 1.1.21 | No fix listed |
| xmlsoft libxslt | = 1.1.22 | No fix listed |
| xmlsoft libxslt | = 1.1.23 | No fix listed |
| xmlsoft libxslt | = 1.1.24 | No fix listed |
| debian/libxslt(Debian:12) | < 1.1.24-2 | 1.1.24-2 |
| debian/libxslt(Debian:13) | < 1.1.24-2 | 1.1.24-2 |
| debian/libxslt(Debian:14) | < 1.1.24-2 | 1.1.24-2 |
References
- Debian Security Tracker CVE-2008-2935 vendor-advisory
- bugs.debian.org issue-tracking
- 31230 third-party-advisory
- 31310 third-party-advisory
- 31331 third-party-advisory
- 31363 third-party-advisory
- 31395 third-party-advisory
- 31399 third-party-advisory
- 32453 third-party-advisory
- GLSA-200808-06 vendor-advisory
- 4078 third-party-advisory
- wiki.rpath.com
- DSA-1624 vendor-advisory
- MDVSA-2008:160 vendor-advisory
- www.ocert.org patch
- www.ocert.org exploit patch
- RHSA-2008:0649 vendor-advisory
- www.scary.beasts.org
- 20080731 [oCERT-2008-009] libxslt heap overflow mailing-list
- 20080801 libxslt heap overflow mailing-list
- 20081027 rPSA-2008-0306-1 libxslt mailing-list
- 30467 vdb-entry
- 1020596 vdb-entry
- USN-633-1 vendor-advisory
- ADV-2008-2266 vdb-entry
- libxslt-multiple-crypto-bo(44141) vdb-entry
- oval:org.mitre.oval:def:10827 signature vdb-entry
- FEDORA-2008-7029 vendor-advisory
- FEDORA-2008-7062 vendor-advisory