Vulnerability Report

CVE-2008-2935

Title: Xmlsoft Libxslt RCE

Memory Corruption

Proof Of Concept

PoC Available for CVE-2008-2935

CWE Category CWE-119

Published Date Aug 01, 2008

Modified Date Jun 16, 2026

Exploit Status Available

Score 7.5 CVSS v2.0

Exploit Probability (EPSS)

12.79%

Vulnerability Summary

CVE-2008-2935: Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Impacted Vendors

xmlsoft 1

Reference Links

http://secunia.com/advisories/31230 http://secunia.com/advisories/31310 http://secunia.com/advisories/31331 http://secunia.com/advisories/31363 http://secunia.com/advisories/31395 http://secunia.com/advisories/31399 http://secunia.com/advisories/32453 http://security.gentoo.org/glsa/glsa-200808-06.xml http://securityreason.com/securityalert/4078 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0306 http://www.debian.org/security/2008/dsa-1624 http://www.mandriva.com/security/advisories?name=MDVSA-2008:160 http://www.ocert.org/advisories/ocert-2008-009.html http://www.ocert.org/patches/exslt_crypt.patch http://www.redhat.com/support/errata/RHSA-2008-0649.html http://www.scary.beasts.org/security/CESA-2008-003.html http://www.securityfocus.com/archive/1/494976/100/0/threaded http://www.securityfocus.com/archive/1/495018/100/0/threaded http://www.securityfocus.com/archive/1/497829/100/0/threaded http://www.securityfocus.com/bid/30467 http://www.securitytracker.com/id?1020596 http://www.ubuntu.com/usn/usn-633-1 http://www.vupen.com/english/advisories/2008/2266/references https://exchange.xforce.ibmcloud.com/vulnerabilities/44141 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10827 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00092.html https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00118.html http://secunia.com/advisories/31230 http://secunia.com/advisories/31310 http://secunia.com/advisories/31331 http://secunia.com/advisories/31363 http://secunia.com/advisories/31395 http://secunia.com/advisories/31399 http://secunia.com/advisories/32453 http://security.gentoo.org/glsa/glsa-200808-06.xml http://securityreason.com/securityalert/4078 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0306 http://www.debian.org/security/2008/dsa-1624 http://www.mandriva.com/security/advisories?name=MDVSA-2008:160 http://www.ocert.org/advisories/ocert-2008-009.html http://www.ocert.org/patches/exslt_crypt.patch http://www.redhat.com/support/errata/RHSA-2008-0649.html http://www.scary.beasts.org/security/CESA-2008-003.html http://www.securityfocus.com/archive/1/494976/100/0/threaded http://www.securityfocus.com/archive/1/495018/100/0/threaded http://www.securityfocus.com/archive/1/497829/100/0/threaded http://www.securityfocus.com/bid/30467 http://www.securitytracker.com/id?1020596 http://www.ubuntu.com/usn/usn-633-1 http://www.vupen.com/english/advisories/2008/2266/references https://exchange.xforce.ibmcloud.com/vulnerabilities/44141 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10827 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00092.html https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00118.html

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2008-2935 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/32133

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

August 01, 2008 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.