This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] libxml2 fixes 3 vulnerabilities
libxml2 fixes 3 vulnerabilities in versions 2.12.10 and 2.13.6 [1][2][3], which so far have been fixed only by Slackware [4].
By inserting a specially crafted XML file, an unauthenticated local attacker can access memory without authorization [1].
The vulnerability is present in product:
- *:libxml2; <2.12.10; >=2.13, <2.13.6;
CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2024-56171 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 18. 2. 2025.
An unauthenticated local attacker can access memory beyond the stack boundary without authorization. The vulnerability is exploitable only if DTD validation is used for the inserted document [2].
The vulnerability is present in product:
- *:libxml2; <2.12.10; >=2.13, <2.13.6;
CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2025-24928 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 18. 2. 2025.
An unauthenticated local attacker can cause a DoS attack through incorrect memory access [3]
The vulnerability is present in product:
- *:libxml2; <2.12.10; >=2.13, <2.13.6;
CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2025-27113 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 18. 2. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 20. 2. 2025.