NuytsTech Security

CVE-2008-2935

by ·

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Date published : 2008-08-01

http://www.securityfocus.com/bid/30467

http://www.securityfocus.com/archive/1/494976/100/0/threaded

Tags: