CVE-2024-58377

Name	CVE-2024-58377
Description	Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-nokogiri (PTS)	bullseye	1.11.1+dfsg-2	fixed
	bullseye (security)	1.11.1+dfsg-2+deb11u1	fixed
	bookworm	1.13.10+dfsg-2	fixed
	trixie	1.18.2+dfsg-1	fixed
	forky, sid	1.19.4+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-nokogiri	source	(unstable)	(not affected)

- ruby-nokogiri <not-affected> (Debian uses the system copy of libxml)