CVE-2025-8732

Name
CVE-2025-8732
Description
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
exploit https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link
issue-tracking https://gitlab.gnome.org/GNOME/libxml2/-/issues/958
issue-tracking https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853
signature https://vuldb.com/?ctiid.319228
vdb-entry https://vuldb.com/?id.319228
third-party-advisory https://vuldb.com/?submit.622285
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Match rules

CPE URI Source package Min version Max version
libxml2 == 2.14.0 == 2.14.0
libxml2 == 2.14.1 == 2.14.1
libxml2 == 2.14.2 == 2.14.2
libxml2 == 2.14.3 == 2.14.3
libxml2 == 2.14.4 == 2.14.4
libxml2 == 2.14.5 == 2.14.5
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* libxml2 >= None < 2.15.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxml2 edge-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.6-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.5-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.12.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.5-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.3-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.2-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.1-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.11.0-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.4-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.3-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.2-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.2-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.1-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.10.0-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.14-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.14-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.13-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.11-r0 None possibly vulnerable
libxml2 edge-main 2.9.10-r7 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.9.10-r5 None possibly vulnerable
libxml2 edge-main 2.9.10-r4 None possibly vulnerable
libxml2 edge-main 2.9.8-r3 None possibly vulnerable
libxml2 edge-main 2.9.8-r1 None possibly vulnerable
libxml2 edge-main 2.9.4-r4 None possibly vulnerable
libxml2 edge-main 2.9.4-r2 None possibly vulnerable
libxml2 edge-main 2.9.4-r1 None possibly vulnerable
libxml2 3.24-main 2.13.9-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.23-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.23-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.22-main 2.13.6-r0 None possibly vulnerable
libxml2 3.22-main 2.12.7-r0 None possibly vulnerable
libxml2 3.22-main 2.12.5-r0 None possibly vulnerable
libxml2 3.22-main 2.10.4-r0 None possibly vulnerable
libxml2 3.22-main 2.10.3-r0 None possibly vulnerable
libxml2 3.22-main 2.10.0-r0 None possibly vulnerable
libxml2 3.22-main 2.9.14-r0 None possibly vulnerable
libxml2 3.22-main 2.9.13-r0 None possibly vulnerable
libxml2 3.22-main 2.9.11-r0 None possibly vulnerable
libxml2 3.22-main 2.9.10-r5 None possibly vulnerable
libxml2 3.22-main 2.9.10-r4 None possibly vulnerable
libxml2 3.22-main 2.9.8-r3 None possibly vulnerable
libxml2 3.22-main 2.9.8-r1 None possibly vulnerable
libxml2 3.22-main 2.9.4-r4 None possibly vulnerable
libxml2 3.22-main 2.9.4-r2 None possibly vulnerable
libxml2 3.22-main 2.9.4-r1 None possibly vulnerable
libxml2 3.21-main 2.13.9-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.9-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r6 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r5 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r4 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.21-main 2.12.7-r0 None possibly vulnerable
libxml2 3.21-main 2.12.5-r0 None possibly vulnerable
libxml2 3.21-main 2.10.4-r0 None possibly vulnerable
libxml2 3.21-main 2.10.3-r0 None possibly vulnerable
libxml2 3.21-main 2.10.0-r0 None possibly vulnerable
libxml2 3.21-main 2.9.14-r0 None possibly vulnerable
libxml2 3.21-main 2.9.13-r0 None possibly vulnerable
libxml2 3.21-main 2.9.11-r0 None possibly vulnerable
libxml2 3.21-main 2.9.10-r5 None possibly vulnerable
libxml2 3.21-main 2.9.10-r4 None possibly vulnerable
libxml2 3.21-main 2.9.8-r3 None possibly vulnerable
libxml2 3.21-main 2.9.8-r1 None possibly vulnerable
libxml2 3.21-main 2.9.4-r4 None possibly vulnerable
libxml2 3.21-main 2.9.4-r2 None possibly vulnerable
libxml2 3.21-main 2.9.4-r1 None possibly vulnerable
libxml2 3.20-main 2.12.10-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r3 None possibly vulnerable
libxml2 3.20-main 2.12.7-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.20-main 2.12.5-r0 None possibly vulnerable
libxml2 3.20-main 2.10.4-r0 None possibly vulnerable
libxml2 3.20-main 2.10.3-r0 None possibly vulnerable
libxml2 3.20-main 2.10.0-r0 None possibly vulnerable
libxml2 3.20-main 2.9.14-r0 None possibly vulnerable
libxml2 3.20-main 2.9.13-r0 None possibly vulnerable
libxml2 3.20-main 2.9.11-r0 None possibly vulnerable
libxml2 3.20-main 2.9.10-r5 None possibly vulnerable
libxml2 3.20-main 2.9.10-r4 None possibly vulnerable
libxml2 3.20-main 2.9.8-r3 None possibly vulnerable
libxml2 3.20-main 2.9.8-r1 None possibly vulnerable
libxml2 3.20-main 2.9.4-r4 None possibly vulnerable
libxml2 3.20-main 2.9.4-r2 None possibly vulnerable
libxml2 3.20-main 2.9.4-r1 None possibly vulnerable
libxml2 3.19-main 2.11.8-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r2 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r1 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.8-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.7-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.11.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 3.19-main 2.10.4-r0 None possibly vulnerable
libxml2 3.19-main 2.10.3-r0 None possibly vulnerable
libxml2 3.19-main 2.10.0-r0 None possibly vulnerable
libxml2 3.19-main 2.9.14-r0 None possibly vulnerable
libxml2 3.19-main 2.9.13-r0 None possibly vulnerable
libxml2 3.19-main 2.9.11-r0 None possibly vulnerable
libxml2 3.19-main 2.9.10-r5 None possibly vulnerable
libxml2 3.19-main 2.9.10-r4 None possibly vulnerable
libxml2 3.19-main 2.9.8-r3 None possibly vulnerable
libxml2 3.19-main 2.9.8-r1 None possibly vulnerable
libxml2 3.19-main 2.9.4-r4 None possibly vulnerable
libxml2 3.19-main 2.9.4-r2 None possibly vulnerable
libxml2 3.19-main 2.9.4-r1 None possibly vulnerable