CVE-2024-25062

Name
CVE-2024-25062
Description
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
cve@mitre.org https://gitlab.gnome.org/GNOME/libxml2/-/tags

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= None < 2.11.7
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= 2.12.0 < 2.12.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxml2 3.17-main 2.10.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.16-main 2.9.14-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable