Lucene search

RedhatCVE-2008-2935

HistoryAug 01, 2008 - 2:41 p.m.

CVE-2008-2935

2008-08-0114:41:00

CWE-119

redhat

web.nvd.nist.gov

cve-2008-2935

libxslt

buffer overflow

encryption

decryption

xml

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

0.18

Percentile

96.2%

JSON

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as “an argument in the XSL input.”

Affected configurations

Nvd

Node

xmlsoftlibxsltMatch1.1.8

xmlsoftlibxsltMatch1.1.9

xmlsoftlibxsltMatch1.1.10

xmlsoftlibxsltMatch1.1.11

xmlsoftlibxsltMatch1.1.12

xmlsoftlibxsltMatch1.1.13

xmlsoftlibxsltMatch1.1.14

xmlsoftlibxsltMatch1.1.15

xmlsoftlibxsltMatch1.1.16

xmlsoftlibxsltMatch1.1.17

xmlsoftlibxsltMatch1.1.18

xmlsoftlibxsltMatch1.1.19

xmlsoftlibxsltMatch1.1.20

xmlsoftlibxsltMatch1.1.21

xmlsoftlibxsltMatch1.1.22

xmlsoftlibxsltMatch1.1.23

xmlsoftlibxsltMatch1.1.24

VendorProductVersionCPE
xmlsoftlibxslt1.1.17cpe:/a:xmlsoft:libxslt:1.1.17:::
xmlsoftlibxslt1.1.24cpe:/a:xmlsoft:libxslt:1.1.24:::
xmlsoftlibxslt1.1.9cpe:/a:xmlsoft:libxslt:1.1.9:::
xmlsoftlibxslt1.1.19cpe:/a:xmlsoft:libxslt:1.1.19:::
xmlsoftlibxslt1.1.23cpe:/a:xmlsoft:libxslt:1.1.23:::
xmlsoftlibxslt1.1.18cpe:/a:xmlsoft:libxslt:1.1.18:::
xmlsoftlibxslt1.1.22cpe:/a:xmlsoft:libxslt:1.1.22:::
xmlsoftlibxslt1.1.20cpe:/a:xmlsoft:libxslt:1.1.20:::
xmlsoftlibxslt1.1.12cpe:/a:xmlsoft:libxslt:1.1.12:::
xmlsoftlibxslt1.1.13cpe:/a:xmlsoft:libxslt:1.1.13:::

Vendor	Product	Version	CPE
xmlsoft	libxslt	1.1.17	cpe:/a:xmlsoft:libxslt:1.1.17:::
xmlsoft	libxslt	1.1.24	cpe:/a:xmlsoft:libxslt:1.1.24:::
xmlsoft	libxslt	1.1.9	cpe:/a:xmlsoft:libxslt:1.1.9:::
xmlsoft	libxslt	1.1.19	cpe:/a:xmlsoft:libxslt:1.1.19:::
xmlsoft	libxslt	1.1.23	cpe:/a:xmlsoft:libxslt:1.1.23:::
xmlsoft	libxslt	1.1.18	cpe:/a:xmlsoft:libxslt:1.1.18:::
xmlsoft	libxslt	1.1.22	cpe:/a:xmlsoft:libxslt:1.1.22:::
xmlsoft	libxslt	1.1.20	cpe:/a:xmlsoft:libxslt:1.1.20:::
xmlsoft	libxslt	1.1.12	cpe:/a:xmlsoft:libxslt:1.1.12:::
xmlsoft	libxslt	1.1.13	cpe:/a:xmlsoft:libxslt:1.1.13:::