CVEvulnerability
CVE-2024-25062
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-02-04
- Last modified
- 2026-10-15
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-416
Description
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
Affected configurations
• xmlsoft libxml2 (< 2.11.7)
• xmlsoft libxml2 (>= 2.12.0 < 2.12.5)
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 Exploit, Issue Tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/tags Release Notes
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 Exploit, Issue Tracking
- https://gitlab.gnome.org/GNOME/libxml2/-/tags Release Notes
- https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html lists.debian.org
- https://security.netapp.com/advisory/ntap-20241018-0009/ security.netapp.com
- https://cert-portal.siemens.com/productcert/html/ssa-784301.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html cert-portal.siemens.com