CVE-2008-2935

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction)…

published August 1, 2008

CVSS

—

EPSS

13%

Percentile

96.3

In the wild

Unconfirmed

What it is

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.12789 · 96.3th percentile
Published: 2008-08-01T14:00Z

EPSS history

Timeline

01 AUG 14:00Z
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction)…
cvelistv5