Log in Start free

Vulnerability · Published Feb 4, 2024 · Assigned by mitre

CVE-2024-25062

High 7.5

In plain English

A high-severity use-after-free in the libxml2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml22.9.7-18.el8_10.1ALSA-2024:3626
AlmaLinux:9libxml22.9.13-6.el9_4ALSA-2024:2679
AlmaLinux:8libxml2-devel2.9.7-18.el8_10.1ALSA-2024:3626
AlmaLinux:9libxml2-devel2.9.13-6.el9_4ALSA-2024:2679
AlmaLinux:8python3-libxml22.9.7-18.el8_10.1ALSA-2024:3626
AlmaLinux:9python3-libxml22.9.13-6.el9_4ALSA-2024:2679
Alpine:v3.20libxml22.12.5-r0ALPINE-CVE-2024-25062
Alpine:v3.21libxml22.12.5-r0ALPINE-CVE-2024-25062
Alpine:v3.22libxml22.12.5-r0ALPINE-CVE-2024-25062
Alpine:v3.23libxml22.12.5-r0ALPINE-CVE-2024-25062
Alpine:v3.24libxml22.12.5-r0ALPINE-CVE-2024-25062
Alpine:v3.20qt6-qtwebengine6.6.3-r1ALPINE-CVE-2024-25062
Alpine:v3.21qt6-qtwebengine6.6.3-r1ALPINE-CVE-2024-25062
Alpine:v3.22qt6-qtwebengine6.6.3-r1ALPINE-CVE-2024-25062
Alpine:v3.23qt6-qtwebengine6.6.3-r1ALPINE-CVE-2024-25062
Alpine:v3.24qt6-qtwebengine6.6.3-r1ALPINE-CVE-2024-25062
Debian:12libxml22.9.14+dfsg-1.3~deb12u2DSA-5949-1
Debian:12libxml22.9.14+dfsg-1.3~deb12u2DEBIAN-CVE-2024-25062
Debian:13libxml22.12.7+dfsg+really2.9.14-1DEBIAN-CVE-2024-25062
Debian:14libxml22.12.7+dfsg+really2.9.14-1DEBIAN-CVE-2024-25062
Rocky Linux:8libxml20:2.9.7-18.el8_10.1RLSA-2024:3626
Rocky Linux:9libxml20:2.9.13-6.el9_4RLSA-2024:2679
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.4UBUNTU-CVE-2024-25062
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.4USN-6658-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References