An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libxml2-develUpgrade libxml2Upgrade python3-libxml2 | May 13, 2024 | Feb 4, 2024 |
| Alpine Linux | — | Upgrade libxml2Upgrade qt6-qtwebengine | Mar 26, 2024 | Feb 4, 2024 |
| Azul Zulu | — | Apply Azul Zulu JDK 23 installer 23.30.13 (JDK 23.0.1+11, PSU) (short-term support); migrate to JDK 25 (LTS)Upgrade to Azul Zulu JDK 11 installer 11.75.12 (JDK 11.0.24.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.81.0.12 (JDK 8u431-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 17 installer 17.53.12 (JDK 17.0.12.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.37.12 (JDK 21.0.4.0.101+1, quarterly CPU) (LTS stream) | Nov 18, 2024 | Feb 4, 2024 |
| Debian | — | Upgrade libxml2 | Feb 24, 2025 | Feb 4, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 8, 2024 |
| Freebsd | — | Upgrade electron27Upgrade electron28 | Dec 10, 2025 | Mar 7, 2024 |
| Gentoo Linux | — | Upgrade dev-libs/libxml2. | Feb 12, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-libxml2Upgrade libxml2 | May 13, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-libxml2Upgrade libxml2 | Jun 3, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libxml2Upgrade python3-libxml2 | May 31, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libxml2Upgrade libxml2-pythonUpgrade libxml2-devel | Oct 8, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libxml2Upgrade libxml2Upgrade libxml2-develUpgrade python3-libxml2 | Jul 23, 2024 | Feb 4, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-libxml2Upgrade libxml2 | Apr 9, 2024 | Feb 4, 2024 |
| Ibm Aix | — | Apply the fix or workaround for libxml2_advisory6 | May 10, 2024 | Feb 4, 2024 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 24, 2024 | Feb 4, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade libxml2-develUpgrade libxml2Upgrade python3-libxml2 | May 7, 2024 | Feb 4, 2024 |
| Redhat_linux | — | Upgrade libxml2Upgrade libxml2-develNo solution existsUpgrade libxml2-debuginfoUpgrade python3-libxml2-debuginfoUpgrade libxml2-debugsourceUpgrade python3-libxml2 | May 10, 2024 | Feb 4, 2024 |
| Rocky_linux | — | Upgrade python3-libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2Upgrade libxml2-develUpgrade libxml2-debuginfoUpgrade libxml2-debugsource | May 13, 2024 | Feb 4, 2024 |
| Suse | — | Upgrade libxml2-devel-32bitUpgrade python-libxml2Upgrade python313-libxml2Upgrade python3-libxml2-pythonUpgrade python311-libxml2Upgrade libxml2-develUpgrade libxml2-2-32bitUpgrade libxml2-2Upgrade libxml2-toolsUpgrade python3-libxml2Upgrade python2-libxml2-pythonUpgrade libxml2-doc | Feb 14, 2024 | Feb 4, 2024 |
| Ubuntu | — | Upgrade libxml2Upgrade libxml2 (Ubuntu Pro) | Feb 27, 2024 | Feb 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub