Upstream information

CVE-2008-2935 at MITRE

Description

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 7.5
Vector AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
SUSE Bugzilla entry: 410256 [RESOLVED / FIXED]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE 11.0
  • libxslt >= 1.1.23-13.2
  • libxslt-32bit >= 1.1.23-13.2
  • libxslt-64bit >= 1.1.23-13.2
  • libxslt-devel >= 1.1.23-13.2
  • libxslt-devel-32bit >= 1.1.23-13.2
  • libxslt-devel-64bit >= 1.1.23-13.2