Red Hat Security AdvisoryRHSA-2025:12098
libxml2 security update
Released 2025-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.10
- Red Hat Enterprise Linux AppStream E4S (v.8.6) libxml2-devel-2.9.7-13.el8_6.10
- Red Hat Enterprise Linux AppStream TUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.10
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2-2.9.7-13.el8_6.10, python3-libxml2-2.9.7-13.el8_6.10
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxml2-2.9.7-13.el8_6.10, python3-libxml2-2.9.7-13.el8_6.10
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxml2-2.9.7-13.el8_6.10, python3-libxml2-2.9.7-13.el8_6.10
Fixes 4 records
Priority HIGH 72
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01367 · Published 2025-06-12 · Partial fix · 2.14.4, 2.12.5-7.el10_0 +21 CWE-787
Priority HIGH 66
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00384 · Published 2025-04-08 · Partial fix · 2.13.8, 2.14.2 CWE-393
Priority MEDIUM 48
A vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01558 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +34 CWE-125
Priority MEDIUM 47
A use-after-free vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00833 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +33 CWE-825
