CVE-2008-2935
libxslt - arbitrary code execution
EPSS 22.1%
Description
Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."
How to fix CVE-2008-2935
To remediate CVE-2008-2935, upgrade the affected package to a fixed version below.
- Debian/libxslt—upgrade to 1.1.24-2 or later
- Debian/libxslt—upgrade to 1.1.19-3 or later
- —upgrade to 1.1.24-1+lenny1 or later
Is CVE-2008-2935 being exploited?
Moderate — EPSS is 22.1%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (3)
- from 0, < 1.1.24-2
- from 0, < 1.1.19-3
- from 0, < 1.1.24-1+lenny1