National Cyber Awareness System

Vulnerability Summary for CVE-2008-1767

Overview

Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: libxslt-xsl-code-execution(42560)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42560

External Source: XF

Name: libxslt-xsl-bo(42560)

Hyperlink:http://xforce.iss.net/xforce/xfdb/42560

External Source: VUPEN

Name: ADV-2008-2780

Hyperlink:http://www.vupen.com/english/advisories/2008/2780

External Source: VUPEN

Name: ADV-2008-2094

Hyperlink:http://www.vupen.com/english/advisories/2008/2094/references

External Source: VUPEN

Name: ADV-2008-1580

Hyperlink:http://www.vupen.com/english/advisories/2008/1580/references

External Source: UBUNTU

Name: USN-633-1

Hyperlink:http://www.ubuntu.com/usn/usn-633-1

External Source: SECTRACK

Name: 1020071

Hyperlink:http://www.securitytracker.com/id?1020071

External Source: BID

Name: 31681

Hyperlink:http://www.securityfocus.com/bid/31681

External Source: BID

Name: 29312

Hyperlink:http://www.securityfocus.com/bid/29312

External Source: REDHAT

Name: RHSA-2008:0287

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0287.html

External Source: SUSE

Name: SUSE-SR:2008:013

Hyperlink:http://www.novell.com/linux/security/advisories/2008_13_sr.html

External Source: MANDRIVA

Name: MDVSA-2008:151

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:151

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3298

Hyperlink:http://support.apple.com/kb/HT3298

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3216

Hyperlink:http://support.apple.com/kb/HT3216

External Source: SECUNIA

Name: 32706

Hyperlink:http://secunia.com/advisories/32706

External Source: SECUNIA

Name: 32222

Hyperlink:http://secunia.com/advisories/32222

External Source: SECUNIA

Name: 31363

Hyperlink:http://secunia.com/advisories/31363

External Source: SECUNIA

Name: 31074

Hyperlink:http://secunia.com/advisories/31074

External Source: SECUNIA

Name: 30717

Hyperlink:http://secunia.com/advisories/30717

External Source: SECUNIA

Name: 30323

Type: Advisory

Hyperlink:http://secunia.com/advisories/30323

External Source: SECUNIA

Name: 30315

Type: Advisory

Hyperlink:http://secunia.com/advisories/30315

External Source: OVAL

Name: oval:org.mitre.oval:def:9785

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9785

External Source: APPLE

Name: APPLE-SA-2008-10-09

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

External Source: APPLE

Name: APPLE-SA-2008-07-11

Hyperlink:http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html

External Source: APPLE

Name: APPLE-SA-2008-11-13

Hyperlink:http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html

External Source: CONFIRM

Name: http://bugzilla.gnome.org/show_bug.cgi?id=527297

Hyperlink:http://bugzilla.gnome.org/show_bug.cgi?id=527297

External Source: DEBIAN

Name: DSA-1589

Hyperlink:http://www.debian.org/security/2008/dsa-1589

External Source: GENTOO

Name: GLSA-200806-02

Hyperlink:http://security.gentoo.org/glsa/glsa-200806-02.xml

External Source: SECUNIA

Name: 30521

Hyperlink:http://secunia.com/advisories/30521

External Source: SECUNIA

Name: 30393

Hyperlink:http://secunia.com/advisories/30393

References to Check Content

Identifier:oval:org.mitre.oval:def:9785

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9785