ALT-PU-2025-7069-1
Package libxml2 updated to version 2.12.10-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2025-03138
Уязвимость функции xmlPatMatch() в файле pattern.c библиотеки libxml2, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-05193
Уязвимость функции xmlSnprintfElements() библиотеки libxml2, позволяющая нарушителю выполнить произвольный код
Modified: 2025-03-28
CVE-2024-56171
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
Modified: 2025-03-21
CVE-2025-24928
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Modified: 2025-03-07
CVE-2025-27113
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.