An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can…
High CVSS 7.5
Summary
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 Exploit
- https://gitlab.gnome.org/GNOME/libxml2/-/tags Release Notes
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 Exploit
- https://gitlab.gnome.org/GNOME/libxml2/-/tags Release Notes
- https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
- https://security.netapp.com/advisory/ntap-20241018-0009/
- https://cert-portal.siemens.com/productcert/html/ssa-784301.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
Timeline
- nvd_ingest NVD