All errata/sisyphus/ALT-PU-2025-13466-4
ALT-PU-2025-13466-4

Package update libxslt in branch sisyphus

Version1.1.43-alt1
Task#398184
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (5)

BDU:2025-03640
HIGH7.8

Уязвимость файла numbers.ct библиотеки libxslt, позволяющая нарушителю выполнить произвольный код

Published: 2025-04-01Modified: 2026-04-16
CVSS 3.xHIGH 7.8
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS 2.0MEDIUM 5.6
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:C/A:C
References
BDU:2025-03641
HIGH7.8

Уязвимость функции xsltGetInheritedNsList библиотеки libxslt, позволяющая нарушителю оказать влияние на целостность и доступность защищаемой информации

Published: 2025-04-01Modified: 2026-04-20
CVSS 3.xHIGH 7.8
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS 2.0MEDIUM 5.6
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:C/A:C
References
CVE-2025-24855
HIGH7.8

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Published: 2025-03-14Modified: 2025-11-03
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-mrxw-mxhj-p664
HIGH7.8

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

Published: 2025-03-14Modified: 2025-03-21
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
References