{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: NULL pointer dereference in xmlPatMatch\n - debian/patches/libxml2-2.10.2-CVE-2025-27113.patch: compile an\n explicit child:: axis step to XML_OP_ELEM instead of XML_OP_CHILD\n in xmlCompileStepPattern() in pattern.c; backport of upstream\n libxml2 503f788e (v2.12.10, v2.13.6, v2.14.0). XML_OP_CHILD accepts\n a document node and does not advance the current node, so a pattern\n such as \"/child::name\" matched against a document node reached the\n unguarded node->parent load in the XML_OP_ROOT case of xmlPatMatch()\n and crashed. Reachable through the public xmlPatternMatch(), used\n in-tree by xmlTextReaderPreservePattern() and by Schematron rule\n contexts; the streaming matcher already compiled the child axis\n correctly, so XML Schema identity constraints and the XPath\n streaming optimisation are unaffected. Upstream fixed only the\n compiler side and leaves the XML_OP_ROOT load unguarded to this day;\n it is left unguarded here too, and no in-tree caller reaches it.\n Behaviour change: patterns using the explicit child:: axis now\n select the named element itself rather than its parent, which is\n correct XPath and what the streaming matcher already did\n - CVE-2025-27113\n * SECURITY UPDATE: heap out-of-bounds read in xmlSchemaIDCFillNodeTables\n - debian/patches/libxml2-2.10.2-CVE-2025-32415.patch: use the live\n bind->nbNodes instead of the stale local nbNodeTable for both the\n guard and the terminator of the IDC node-table loop in\n xmlSchemaIDCFillNodeTables in xmlschemas.c; backport of upstream\n libxml2 384cc7c1 (v2.13.8), whose master twin is 487ee1d8\n (v2.14.2). nbNodeTable is snapshotted before the target loop, but\n the loop shrinks the node table every time it moves a duplicate\n key-sequence to bind->dupls, so from the next target onwards the\n loop walks slots past the live end of the table; once the table is\n empty the guard is still true and a match evaluates\n bind->nodeTable[-1], reading one element before the start of the\n heap allocation and leaving bind->nbNodes negative for the targets\n that follow. Reachable from schema validation of an untrusted\n instance document against a schema carrying identity constraints,\n or from an untrusted schema. Applied on top of\n libxml2-2.10.2-CVE-2024-56171.patch, which edits the same function\n but a different defect (a stale pointer rather than a stale count)\n and does not overlap these hunks\n - CVE-2025-32415\n * SECURITY UPDATE: integer overflow in xmlBuildQName leading to a\n stack-based buffer overflow\n - debian/patches/libxml2-2.10.2-CVE-2025-6021.patch: hold the\n local-name and prefix lengths in size_t, reject a negative len, and\n bound lenn + lenp + 2 against SIZE_MAX before the buffer-size test\n and the allocation, in tree.c; backport of upstream libxml2\n 17d950ae (v2.13.9). The lengths were held in int and summed in int\n arithmetic, so a long enough QName made lenn + lenp + 2 wrap\n negative, which both defeated the buffer-size test - handing back a\n caller's 50-byte stack buffer - and undersized the xmlMallocAtomic()\n allocation, letting the following memcpy()s and the NUL store write\n out of bounds\n - CVE-2025-6021\n * SECURITY UPDATE: stack-based buffer overflows in xmlcatalog --shell\n - debian/patches/libxml2-2.10.2-CVE-2026-11979.patch: bounds-check the\n three copy loops in usershell() in xmlcatalog.c, which wrote a line\n of user input into the fixed command[100], arg[400] and argv[20]\n stack buffers with no limit at all; backport of upstream libxml2\n cd48d441 (v2.15.4), whose xmlcatalog.c hunks are identical to\n master's c2e233fc. Over-long input is now rejected with a diagnostic\n instead of corrupting the stack frame. Upstream's\n test/catalogs/test.sh hunk is dropped because that file does not\n exist in 2.10.2; usershell() itself is byte-identical to upstream's\n pre-fix version, so the guards are carried verbatim. Affects only\n the xmlcatalog command-line utility shipped by this package -- no\n library entry point reaches usershell()\n - CVE-2026-11979\n * Harden the xmlcatalog command line parser\n - debian/patches/libxml2-2.10.2-xmlcatalog-argv-oob-read.patch: check\n that --add and --del were given enough arguments before indexing\n argv in main() in xmlcatalog.c; backport of upstream libxml2\n b1fea45b. This is not a CVE and is not part of CVE-2026-11979; it\n is carried alongside it because upstream shipped both in the same\n release and both touch the same file. \"xmlcatalog --add a\" read\n argv[4] past the end of the argument vector and passed whatever\n followed it, in practice a process environment string, to\n xmlCatalogAdd()", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/debian13/advisories/2026/clsa-2026_1789670247.json" } ], "tracking": { "current_release_date": "2026-09-17T18:38:47Z", "generator": { "date": "2026-09-17T18:38:47Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789670247", "initial_release_date": "2026-09-17T18:38:47Z", "revision_history": [ { "date": "2026-09-17T18:38:47Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix of 8 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 13", "product": { "name": "Debian 13", "product_id": "Debian-13", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-7.amd64", "product": { "name": "alt-libxml2-static-0:2.10.2-7.amd64", "product_id": "alt-libxml2-static-0:2.10.2-7.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-static@2.10.2-7?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-7.amd64", "product": { "name": "alt-libxml2-devel-0:2.10.2-7.amd64", "product_id": "alt-libxml2-devel-0:2.10.2-7.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-devel@2.10.2-7?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-7.amd64", "product": { "name": "alt-libxml2-0:2.10.2-7.amd64", "product_id": "alt-libxml2-0:2.10.2-7.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2@2.10.2-7?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-0:2.10.2-5.amd64", "product_id": "alt-libxml2-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-devel-0:2.10.2-5.amd64", "product_id": "alt-libxml2-devel-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-devel@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-static-0:2.10.2-5.amd64", "product_id": "alt-libxml2-static-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-static@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-static-0:2.10.2-4.amd64", "product_id": "alt-libxml2-static-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-static@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-devel-0:2.10.2-4.amd64", "product_id": "alt-libxml2-devel-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-devel@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-0:2.10.2-4.amd64", "product_id": "alt-libxml2-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "alt-libxml2-doc-0:2.10.2-7.all", "product": { "name": "alt-libxml2-doc-0:2.10.2-7.all", "product_id": "alt-libxml2-doc-0:2.10.2-7.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-doc@2.10.2-7?arch=all&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-doc-0:2.10.2-5.all", "product": { "name": "alt-libxml2-doc-0:2.10.2-5.all", "product_id": "alt-libxml2-doc-0:2.10.2-5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-doc@2.10.2-5?arch=all&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-doc-0:2.10.2-4.all", "product": { "name": "alt-libxml2-doc-0:2.10.2-4.all", "product_id": "alt-libxml2-doc-0:2.10.2-4.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-doc@2.10.2-4?arch=all&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-7.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" }, "product_reference": "alt-libxml2-static-0:2.10.2-7.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-doc-0:2.10.2-7.all as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-doc-0:2.10.2-7.all" }, "product_reference": "alt-libxml2-doc-0:2.10.2-7.all", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-7.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-7.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-7.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-0:2.10.2-7.amd64" }, "product_reference": "alt-libxml2-0:2.10.2-7.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-static-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-doc-0:2.10.2-5.all as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-doc-0:2.10.2-5.all" }, "product_reference": "alt-libxml2-doc-0:2.10.2-5.all", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-static-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-doc-0:2.10.2-4.all as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-doc-0:2.10.2-4.all" }, "product_reference": "alt-libxml2-doc-0:2.10.2-4.all", "relates_to_product_reference": "Debian-13" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-11979", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-11979" }, { "category": "external", "summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979", "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e" } ], "release_date": "2026-06-29T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2026-06-29T14:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-32415", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-32415" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html" } ], "release_date": "2025-04-17T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2025-04-17T17:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-49043", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-49043" }, { "category": "external", "summary": "https://github.com/php/php-src/issues/17467", "url": "https://github.com/php/php-src/issues/17467" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" } ], "release_date": "2025-01-26T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2025-01-26T06:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-6021", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-6021" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10630", "url": "https://access.redhat.com/errata/RHSA-2025:10630" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10698", "url": "https://access.redhat.com/errata/RHSA-2025:10698" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10699", "url": "https://access.redhat.com/errata/RHSA-2025:10699" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:11580", "url": "https://access.redhat.com/errata/RHSA-2025:11580" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:11673", "url": "https://access.redhat.com/errata/RHSA-2025:11673" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12098", "url": "https://access.redhat.com/errata/RHSA-2025:12098" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12099", "url": "https://access.redhat.com/errata/RHSA-2025:12099" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12199", "url": "https://access.redhat.com/errata/RHSA-2025:12199" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12237", "url": "https://access.redhat.com/errata/RHSA-2025:12237" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12239", "url": "https://access.redhat.com/errata/RHSA-2025:12239" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12240", "url": "https://access.redhat.com/errata/RHSA-2025:12240" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12241", "url": "https://access.redhat.com/errata/RHSA-2025:12241" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13267", "url": "https://access.redhat.com/errata/RHSA-2025:13267" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13289", "url": "https://access.redhat.com/errata/RHSA-2025:13289" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13325", "url": "https://access.redhat.com/errata/RHSA-2025:13325" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13335", "url": "https://access.redhat.com/errata/RHSA-2025:13335" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13336", "url": "https://access.redhat.com/errata/RHSA-2025:13336" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:14059", "url": "https://access.redhat.com/errata/RHSA-2025:14059" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:14396", "url": "https://access.redhat.com/errata/RHSA-2025:14396" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:15308", "url": "https://access.redhat.com/errata/RHSA-2025:15308" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:15672", "url": "https://access.redhat.com/errata/RHSA-2025:15672" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19020", "url": "https://access.redhat.com/errata/RHSA-2025:19020" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7519", "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2025-6021", "url": "https://access.redhat.com/security/cve/CVE-2025-6021" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2372406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372406" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/926", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/926" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-06-12T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2025-06-12T13:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40303", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-40303" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2022-11-23T00:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40304", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-40304" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2022-11-23T18:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-25062", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2024-25062" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241018-0009/", "url": "https://security.netapp.com/advisory/ntap-20241018-0009/" } ], "release_date": "2024-02-04T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2024-02-04T16:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-27113", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-27113" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/10", "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/11", "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/12", "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/13", "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/4", "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/5", "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/8", "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/9", "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250306-0004/", "url": "https://security.netapp.com/advisory/ntap-20250306-0004/" } ], "release_date": "2025-02-18T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:37:29.738600Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-7.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-7.all", "Debian-13:alt-libxml2-static-0:2.10.2-7.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789670247" }, { "category": "none_available", "date": "2025-02-18T23:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }