CVE-2024-25062

NameCVE-2024-25062
DescriptionAn issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1063234

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxml2 (PTS)buster2.9.4+dfsg1-7+deb10u4vulnerable
buster (security)2.9.4+dfsg1-7+deb10u6vulnerable
bullseye (security), bullseye2.9.10+dfsg-6.7+deb11u4vulnerable
bookworm2.9.14+dfsg-1.3~deb12u1vulnerable
trixie2.9.14+dfsg-1.3vulnerable
sid2.12.7+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxml2sourceexperimental2.12.5+dfsg-0exp1
libxml2source(unstable)2.12.7+dfsg-11063234

Notes

[bookworm] - libxml2 <no-dsa> (Minor issue)
[bullseye] - libxml2 <no-dsa> (Minor issue)
[buster] - libxml2 <no-dsa> (Minor issue)
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7 (v2.11.7)
https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970884fcc13305cb8e23cdc5f0dd7667c2c (v2.12.5)

Search for package or bug name: Reporting problems