Most recent entries from all

ALSA-2024:2679 — Moderate: libxml2 security update

Affected: AlmaLinux:9: libxml2, AlmaLinux:9: libxml2-devel, AlmaLinux:9: python3-libxml2

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

* libxml2: use-after-free in XMLReader (CVE-2024-25062)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-01415

BELL-CVE-2024-25062

Affected: Alpaquita:23: libxml2, Alpaquita:stream: libxml2, BellSoft Hardened Containers:23: libxml2, BellSoft Hardened Containers:stream: libxml2

BIT-java-2024-25062

Affected: Bitnami: java

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

certfr-2024-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0579

EUVD-2026-258572

fkie_cve-2024-25062

GHSA-x77r-6xxm-wjmx

gsd-2024-25062

ICSA-23-166-11 — Siemens SIMATIC S7-1500 TM MFP Linux Kernel

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference. A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM inst…

msrc_CVE-2024-25062 — An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD…

msrc_CVE-2024-25062

OESA-2024-1183 — libxml2 security update

Affected: openEuler:20.03-LTS-SP1: libxml2, openEuler:20.03-LTS-SP4: libxml2, openEuler:22.03-LTS: libxml2, openEuler:22.03-LTS-SP1: libxml2, openEuler:22.03-LTS-SP2: libxml2, openEuler:22.03-LTS-SP3: libxml2

Library providing XML and HTML support. Security Fix(es): An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.(CVE-2024-25062)

openSUSE-SU-2024:13676-1 — libxml2-2-2.11.6-2.1 on GA media

libxml2-2-2.11.6-2.1 on GA media

RHSA-2024:3299 — Red Hat Security Advisory: libxml2 security update

libxml2: use-after-free in XMLReader

SUSE-SU-2024:0461-1 — Security update for libxml2

Security update for libxml2

UBUNTU-CVE-2024-25062

Affected: Ubuntu:Pro:14.04:LTS: libxml2, Ubuntu:Pro:16.04:LTS: libxml2, Ubuntu:Pro:18.04:LTS: libxml2, Ubuntu:20.04:LTS: libxml2, Ubuntu:22.04:LTS: libxml2

VDE-2025-053 — Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware

Coreutils: heap overflow in split --line-bytes with very long lines Unprivileged overlay + shiftfs read access Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file SSL_select_next_proto buffer overread Remote Code Execution in pypa/setuptools

WID-SEC-W-2024-0280 — libxml2: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libxml2 ausnutzen, um einen Denial of Service Angriff durchzuführen.