In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade python3-libxml2Upgrade libxml2-staticUpgrade libxml2Upgrade libxml2-devel | Jul 10, 2025 | Dec 23, 2024 |
| Redhat_linux | — | — | Jul 9, 2025 | Dec 23, 2024 |
| Suse | — | Upgrade qt6-pdfquick-private-develUpgrade qt6-webengine-docs-htmlUpgrade qt6-pdfquick-develUpgrade qt6-pdf-private-develUpgrade qt6-webenginequick-private-develUpgrade libQt6WebEngineWidgets6Upgrade qt6-webengineUpgrade qt6-webenginewidgets-private-develUpgrade libQt6WebEngineCore6Upgrade libQt6WebEngineQuick6Upgrade qt6-webenginequick-develUpgrade libQt6Pdf6Upgrade qt6-webengine-examplesUpgrade qt6-webenginewidgets-develUpgrade python3-libxml2Upgrade qt6-pdfwidgets-private-develUpgrade python313-libxml2Upgrade qt6-pdf-develUpgrade libxml2-2-32bitUpgrade qt6-pdf-importsUpgrade qt6-webengine-importsUpgrade qt6-pdfwidgets-develUpgrade libQt6PdfQuick6Upgrade qt6-webengine-docs-qchUpgrade libxml2-toolsUpgrade libxml2-develUpgrade libQt6PdfWidgets6Upgrade qt6-webenginecore-private-develUpgrade libxml2-2Upgrade qt6-webenginecore-develUpgrade libxml2-doc | Dec 5, 2025 | Feb 3, 2025 |
| Ubuntu | — | Upgrade libxml2 | Jan 17, 2025 | Dec 23, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub