Все бюллетени/p11/ALT-PU-2026-19670-3
ALT-PU-2026-19670-3

Обновление пакета libxml2 в ветке p11

Версия2.12.10-alt3
Задание#438062
Опубликовано2026-10-30
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (33)

BDU:2025-07144
HIGH7.5

Уязвимость функции xmlBuildQName библиотеки Libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2025-06-19Изменено: 2026-07-23
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Ссылки
BDU:2025-08977
HIGH7.5

Уязвимость функции xmlSchematronFormatReport() компонента Schematron Schema Report библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2025-07-23
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Ссылки
BDU:2025-08978
CRITICAL9.1

Уязвимость функции xmlSchematronFormatReport() библиотеки libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2025-07-23Изменено: 2026-09-28
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:C
Ссылки
BDU:2025-08979
CRITICAL9.1

Уязвимость функции xmlSchematronGetNode библиотеки Libxml2, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2025-07-23Изменено: 2026-09-28
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0КРИТИЧЕСКАЯ 9.4
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:C
Ссылки
BDU:2025-11756
LOW2.5

Уязвимость библиотеки для работы с XML и HTML файлами libxml2, связанная с переполнением буфера в стеке, позволяющая нарушителю выполнить произвольный код

Опубликовано: 2025-09-25Изменено: 2026-03-03
CVSS 3.xНИЗКАЯ 2.5
CVSS:3.x/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 2.0НИЗКАЯ 1.2
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:N/A:P
Ссылки
BDU:2026-02937
MEDIUM6.2

Уязвимость библиотеки Libxml2, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-03-11Изменено: 2026-09-22
CVSS 3.xСРЕДНЯЯ 6.2
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0СРЕДНЯЯ 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C
Ссылки
BDU:2026-03631
MEDIUM5.9

Уязвимость библиотеки libxml2, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-03-24Изменено: 2026-08-31
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0СРЕДНЯЯ 5.4
CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:N/A:C
Ссылки
BDU:2026-03632
LOW2.9

Уязвимость библиотеки libxml2, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-03-24Изменено: 2026-08-31
CVSS 3.xНИЗКАЯ 2.9
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0НИЗКАЯ 1.2
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:N/A:P
Ссылки
BDU:2026-03633
LOW3.7

Уязвимость библиотеки libxml2, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-03-24Изменено: 2026-08-31
CVSS 3.xНИЗКАЯ 3.7
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0НИЗКАЯ 2.6
CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:N/A:P
Ссылки
BDU:2026-04327
HIGH7.8

Уязвимость атрибутов type, atype, flags библиотеки для анализа XML-документов Libxslt, позволяющей нарушителю выполнить произвольный код

Опубликовано: 2026-03-31Изменено: 2026-09-22
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS 2.0СРЕДНЯЯ 5.6
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:C/A:C
Ссылки
CVE-2025-49794
CRITICAL9.1

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Опубликовано: 2025-06-16Изменено: 2026-10-29
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Ссылки
CVE-2025-49795
HIGH7.5

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

Опубликовано: 2025-06-16Изменено: 2026-10-12
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2025-49796
CRITICAL9.1

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

Опубликовано: 2025-06-16Изменено: 2026-10-08
CVSS 3.xКРИТИЧЕСКАЯ 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Ссылки
CVE-2025-6021
HIGH7.5

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Опубликовано: 2025-06-12Изменено: 2026-10-12
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2025-6170
LOW2.5

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

Опубликовано: 2025-06-16Изменено: 2026-10-29
CVSS 3.xНИЗКАЯ 2.5
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Ссылки
CVE-2025-7425
HIGH7.8

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Опубликовано: 2025-07-10Изменено: 2026-10-14
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Ссылки
CVE-2025-8732
LOW1.9

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Опубликовано: 2025-08-08Изменено: 2026-07-01
CVSS 2.0НИЗКАЯ 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:P
CVSS 3.xНИЗКАЯ 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 4.0НИЗКАЯ 1.9
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ссылки
CVE-2025-9714
MEDIUM5.5

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Опубликовано: 2025-09-10Изменено: 2026-10-19
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-0989
LOW3.7

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

Опубликовано: 2026-01-15Изменено: 2026-09-01
CVSS 3.xНИЗКАЯ 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-0990
MEDIUM5.9

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.

Опубликовано: 2026-01-15Изменено: 2026-09-01
CVSS 3.xСРЕДНЯЯ 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-0992
LOW2.9

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Опубликовано: 2026-01-15Изменено: 2026-09-01
CVSS 3.xНИЗКАЯ 2.9
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-11979
LOW1.8

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

Опубликовано: 2026-06-29Изменено: 2026-10-25
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 4.0НИЗКАЯ 1.8
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ссылки
CVE-2026-1757
MEDIUM6.2

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

Опубликовано: 2026-02-02Изменено: 2026-09-01
CVSS 3.xСРЕДНЯЯ 6.2
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-74860
HIGH8.5

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Опубликовано: 2026-09-08Изменено: 2026-10-29
CVSS 3.xВЫСОКАЯ 8.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Ссылки
CVE-2026-76781
MEDIUM5.5

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

Опубликовано: 2026-09-17Изменено: 2026-10-30
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-86137
MEDIUM6.1

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

Опубликовано: 2026-09-05Изменено: 2026-09-15
CVSS 3.xСРЕДНЯЯ 6.1
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Ссылки
CVE-2026-86141
LOW3.3

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

Опубликовано: 2026-09-05Изменено: 2026-09-15
CVSS 3.xНИЗКАЯ 3.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Ссылки
CVE-2026-86142
HIGH7.8

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

Опубликовано: 2026-09-05Изменено: 2026-09-15
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
CVE-2026-86143
HIGH7.3

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

Опубликовано: 2026-09-05Изменено: 2026-09-15
CVSS 3.xВЫСОКАЯ 7.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Ссылки
CVE-2026-86144
HIGH7.8

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

Опубликовано: 2026-09-05Изменено: 2026-09-15
CVSS 3.xВЫСОКАЯ 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ссылки
GHSA-353f-x4gh-cqq8
NONE

Nokogiri patches vendored libxml2 to resolve multiple CVEs

Опубликовано: 2025-07-21
Ссылки