CVE-2008-1767

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-05-23 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.

Affected products

RedHat Desktop: 3
Red Hat Enterprise Linux: 2.1, 3.0, 4.0, 5.0
RedHat Enterprise Linux Desktop: 4, 5
RedHat Enterprise Linux Desktop Workstation: 5
RedHat Linux Advanced Workstation: 2.1

References

http://bugzilla.gnome.org/show_bug.cgi?id=527297
http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html
http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
http://secunia.com/advisories/30315
http://secunia.com/advisories/30323
http://secunia.com/advisories/30393
http://secunia.com/advisories/30521
http://secunia.com/advisories/30717
http://secunia.com/advisories/31074
http://secunia.com/advisories/31363
http://secunia.com/advisories/32222

Get alerted when CVE-2008-1767 or the next vulnerability affects your stack