All errata/p10/ALT-PU-2025-3838-4
ALT-PU-2025-3838-4

Package update libxml2 in branch p10

Version2.9.12-alt1.p10.2
Task#376876
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (9)

BDU:2023-03298
MEDIUM6.5

Уязвимость функции xmlSchemaFixupComplexType (xmlschemas.c) библиотеки Libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2023-06-21Modified: 2026-01-20
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2023-03302
MEDIUM6.5

Уязвимость функции xmlDictComputeFastKey (dict.c) библиотеки Libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2023-06-21Modified: 2026-01-20
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2024-01415
HIGH7.5

Уязвимость функции xmlValidatePopElement компонента XML Reader Interface библиотеки Libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-02-19Modified: 2026-03-04
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2025-03138
HIGH7.5

Уязвимость функции xmlPatMatch() в файле pattern.c библиотеки libxml2, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2025-03-24Modified: 2026-04-16
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
CVE-2023-28484
MEDIUM6.5

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Published: 2023-04-24Modified: 2025-05-30
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
CVE-2023-29469
MEDIUM6.5

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Published: 2023-04-24Modified: 2025-02-04
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
CVE-2024-25062
HIGH7.5

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Published: 2024-02-04Modified: 2025-11-03
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2025-27113
HIGH7.5

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

Published: 2025-02-18Modified: 2025-11-03
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-xc9x-jj77-9p9j
NONE

Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

Published: 2024-02-05Modified: 2025-05-23
References