{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2025-27113: NULL pointer dereference in xmlPatMatch(). An explicit\n child:: axis step compiled to XML_OP_CHILD, an op that accepts a document\n node and does not advance the current node, so a pattern such as\n \"/child::name\" matched against a document node reached the unguarded\n node->parent dereference in the XML_OP_ROOT case. Compile child:: to\n XML_OP_ELEM like the implicit axis (upstream 503f788e), which also makes\n the DOM matcher agree with the streaming matcher. Upstream fixed only the\n compiler side; the XML_OP_ROOT dereference is left unguarded here as it is\n upstream, and no in-tree caller can reach it\n- CVE-2025-32415: heap out-of-bounds read during XML Schema identity-constraint\n validation. xmlSchemaIDCFillNodeTables() snapshotted the IDC node-table length\n before its target loop, but the loop shrinks the table when it moves a\n duplicate key-sequence to bind->dupls. With the stale length the loop rescans\n slots past the live end of the table and, once the table is empty, evaluates\n bind->nodeTable[-1], reading one element before the allocation and driving the\n node count negative. Use the live bind->nbNodes for both the loop guard and\n the loop terminator (upstream 384cc7c1, v2.13.8; master twin 487ee1d8,\n v2.14.2)\n- CVE-2025-6021: fix integer overflow in xmlBuildQName() (tree.c). The\n prefix and local-name lengths were held in int and summed in int\n arithmetic, so a long enough QName made lenn + lenp + 2 wrap negative,\n which both defeated the buffer-size test -- handing back a caller's\n 50-byte stack buffer -- and undersized the xmlMallocAtomic() allocation,\n letting the following memcpy()s and the NUL store write out of bounds.\n The lengths are now size_t, a negative len is rejected, and the sum is\n bounded against SIZE_MAX before it is formed. Backport of upstream\n 17d950ae33c23f87692aa179bacedb6743f3188a.\n- CVE-2026-11979: multiple stack-based buffer overflows in the xmlcatalog\n utility's --shell mode. usershell() copied the command token, the\n argument tail and the argument vector of a line of user input into the\n fixed-size command[100], arg[400] and argv[20] stack buffers with no\n bounds check, so a single over-long line corrupted the stack frame. All\n three copy loops are now bounded and reject over-long input with a\n diagnostic (upstream cd48d441, first released in v2.15.4). Only the\n xmlcatalog command-line utility is affected; no library entry point\n reaches usershell()\n- xmlcatalog: reject --add/--del invocations that run off the end of argv\n (upstream b1fea45b). Not a CVE and not part of CVE-2026-11979; carried\n alongside it because upstream shipped both in the same release and both\n touch xmlcatalog.c. Without it, \"xmlcatalog --add a\" reads argv[4] past the\n end of the argument vector and passes whatever follows - in practice a\n process environment string - to xmlCatalogAdd()", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/el9/advisories/2026/clsa-2026_1789669803.json" } ], "tracking": { "current_release_date": "2026-09-17T18:31:19Z", "generator": { "date": "2026-09-17T18:31:19Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789669803", "initial_release_date": "2026-09-17T18:31:19Z", "revision_history": [ { "date": "2026-09-17T18:31:19Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-libxml2: Fix of 8 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 9", "product": { "name": "Community Enterprise Operating System 9", "product_id": "CentOS-9", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:9:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-9.el9.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-9.el9.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-9.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-9.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-9.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-9.el9.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-9.el9.x86_64", "product_id": "alt-libxml2-0:2.10.2-9.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-9.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-7.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-7.el9.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-7.el9.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-7.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-7.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-7.el9.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-7.el9.x86_64", "product_id": "alt-libxml2-0:2.10.2-7.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-7.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-6.el9.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-6.el9.x86_64", "product_id": "alt-libxml2-0:2.10.2-6.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-6.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-6.el9?arch=x86_64&os_name=centos&os_version=9" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-6.el9.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-6.el9.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-6.el9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-6.el9?arch=x86_64&os_name=centos&os_version=9" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-9.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-9.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-9.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-9.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-9.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-7.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-7.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-7.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-7.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-7.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-6.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-6.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-6.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "relates_to_product_reference": "CentOS-9" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-6.el9.x86_64 as a component of Community Enterprise Operating System 9", "product_id": "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-6.el9.x86_64", "relates_to_product_reference": "CentOS-9" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-11979", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-11979" }, { "category": "external", "summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979", "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e" } ], "release_date": "2026-06-29T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2026-06-29T14:16:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-32415", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-32415" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html" } ], "release_date": "2025-04-17T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2025-04-17T17:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-49043", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-49043" }, { "category": "external", "summary": "https://github.com/php/php-src/issues/17467", "url": "https://github.com/php/php-src/issues/17467" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" } ], "release_date": "2025-01-26T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2025-01-26T06:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-6021", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-6021" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10630", "url": "https://access.redhat.com/errata/RHSA-2025:10630" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10698", "url": "https://access.redhat.com/errata/RHSA-2025:10698" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:10699", "url": "https://access.redhat.com/errata/RHSA-2025:10699" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:11580", "url": "https://access.redhat.com/errata/RHSA-2025:11580" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:11673", "url": "https://access.redhat.com/errata/RHSA-2025:11673" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12098", "url": "https://access.redhat.com/errata/RHSA-2025:12098" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12099", "url": "https://access.redhat.com/errata/RHSA-2025:12099" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12199", "url": "https://access.redhat.com/errata/RHSA-2025:12199" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12237", "url": "https://access.redhat.com/errata/RHSA-2025:12237" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12239", "url": "https://access.redhat.com/errata/RHSA-2025:12239" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12240", "url": "https://access.redhat.com/errata/RHSA-2025:12240" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:12241", "url": "https://access.redhat.com/errata/RHSA-2025:12241" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13267", "url": "https://access.redhat.com/errata/RHSA-2025:13267" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13289", "url": "https://access.redhat.com/errata/RHSA-2025:13289" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13325", "url": "https://access.redhat.com/errata/RHSA-2025:13325" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13335", "url": "https://access.redhat.com/errata/RHSA-2025:13335" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:13336", "url": "https://access.redhat.com/errata/RHSA-2025:13336" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:14059", "url": "https://access.redhat.com/errata/RHSA-2025:14059" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:14396", "url": "https://access.redhat.com/errata/RHSA-2025:14396" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:15308", "url": "https://access.redhat.com/errata/RHSA-2025:15308" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:15672", "url": "https://access.redhat.com/errata/RHSA-2025:15672" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2025:19020", "url": "https://access.redhat.com/errata/RHSA-2025:19020" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7519", "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2025-6021", "url": "https://access.redhat.com/security/cve/CVE-2025-6021" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2372406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372406" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/926", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/926" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ], "release_date": "2025-06-12T13:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2025-06-12T13:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40303", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-40303" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T00:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2022-11-23T00:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-40304", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2022-40304" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/21", "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/24", "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/25", "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/26", "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Dec/27", "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221209-0003/", "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213531", "url": "https://support.apple.com/kb/HT213531" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213533", "url": "https://support.apple.com/kb/HT213533" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213534", "url": "https://support.apple.com/kb/HT213534" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213535", "url": "https://support.apple.com/kb/HT213535" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213536", "url": "https://support.apple.com/kb/HT213536" } ], "release_date": "2022-11-23T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2022-11-23T18:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-25062", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2024-25062" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241018-0009/", "url": "https://security.netapp.com/advisory/ntap-20241018-0009/" } ], "release_date": "2024-02-04T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2024-02-04T16:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-27113", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "known_affected": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-27113" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/10", "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/11", "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/12", "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/13", "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/4", "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/5", "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/8", "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/9", "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250306-0004/", "url": "https://security.netapp.com/advisory/ntap-20250306-0004/" } ], "release_date": "2025-02-18T23:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T18:30:05.200087Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-9.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-9.el9.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789669803" }, { "category": "none_available", "date": "2025-02-18T23:15:00Z", "details": "Affected", "product_ids": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-9:alt-libxml2-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-devel-0:2.10.2-7.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-6.el9.x86_64", "CentOS-9:alt-libxml2-static-0:2.10.2-7.el9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }