Every CVE Search/ Get API key

CVE-2008-2935

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction...

7.5 HighPublic exploitFix available

CVE-2008-2935 is a high vulnerability (CVSS 7.5) in Xmlsoft Libxslt, published July 31, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.8%, the 96th percentile. Fixed in libxslt 1.1.24-2.

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Exploit likelihood

12.8%Down 15.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
CVE-2008-2935
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
CVE-2008-2935
Updated
2026-11-02
EUVDEUVD-2008-2928 No score

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
EUVD-2008-2928
Updated
2026-11-03
GitHub AdvisoriesGHSA-4597-8mcf-pw36 No score

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction...

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
GHSA-4597-8mcf-pw36
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
CVE-2008-2935
Updated
2026-11-02
OSVDEBIAN-CVE-2008-2935 No score

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Record
DEBIAN-CVE-2008-2935
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libxslt
Debian:12
 before 1.1.24-2
1.1.24-2
libxslt
Debian:13
 before 1.1.24-2
1.1.24-2
libxslt
Debian:14
 before 1.1.24-2
1.1.24-2
libxslt
Debian:4.0
 before 1.1.19-3, plus listed versions
1.1.19-11.1.19-2
1.1.19-3
libxslt
Debian:5.0
 before 1.1.24-1+lenny1
1.1.24-1+lenny1
libxslt
Red Hat:enterprise_linux:4::as
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-devel
Red Hat:enterprise_linux:4::as
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-python
Red Hat:enterprise_linux:4::as
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt
Red Hat:enterprise_linux:4::desktop
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
Show 21 moreShow less
Affected packages
PackageAffectedFixed
libxslt-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-devel
Red Hat:enterprise_linux:4::desktop
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-python
Red Hat:enterprise_linux:4::desktop
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt
Red Hat:enterprise_linux:4::es
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-devel
Red Hat:enterprise_linux:4::es
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-python
Red Hat:enterprise_linux:4::es
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt
Red Hat:enterprise_linux:4::ws
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-devel
Red Hat:enterprise_linux:4::ws
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt-python
Red Hat:enterprise_linux:4::ws
 before 0:1.1.11-1.el4_7.2
0:1.1.11-1.el4_7.2
libxslt
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt
Red Hat:enterprise_linux:5::client
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-python
Red Hat:enterprise_linux:5::client
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt
Red Hat:enterprise_linux:5::server
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-devel
Red Hat:enterprise_linux:5::server
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2
libxslt-python
Red Hat:enterprise_linux:5::server
 before 0:1.1.17-2.el5_2.2
0:1.1.17-2.el5_2.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBlibxslt 1.1.x - RC4 Encryption and Decryption functions Buffer Overflow2008-07-31

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open