In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade libxml2-develUpgrade libxml2-staticUpgrade python3-libxml2Upgrade libxml2 | Jul 10, 2025 | Dec 23, 2024 |
| Redhat_linux | — | — | Jul 9, 2025 | Dec 23, 2024 |
| Suse | — | Upgrade qt6-webenginecore-private-develUpgrade libxml2-2Upgrade libxml2-develUpgrade libxml2-toolsUpgrade libQt6PdfQuick6Upgrade qt6-webengine-docs-qchUpgrade qt6-webenginecore-develUpgrade qt6-pdfwidgets-develUpgrade qt6-webengine-importsUpgrade libxml2-docUpgrade libQt6PdfWidgets6Upgrade python313-libxml2Upgrade qt6-pdf-develUpgrade qt6-pdfwidgets-private-develUpgrade qt6-pdf-importsUpgrade libxml2-2-32bitUpgrade python3-libxml2Upgrade qt6-webengine-docs-htmlUpgrade libQt6WebEngineCore6Upgrade qt6-webenginewidgets-private-develUpgrade libQt6Pdf6Upgrade qt6-pdfquick-private-develUpgrade qt6-webengineUpgrade qt6-webengine-examplesUpgrade libQt6WebEngineWidgets6Upgrade libQt6WebEngineQuick6Upgrade qt6-pdfquick-develUpgrade qt6-pdf-private-develUpgrade qt6-webenginequick-develUpgrade qt6-webenginequick-private-develUpgrade qt6-webenginewidgets-devel | Dec 5, 2025 | Feb 3, 2025 |
| Ubuntu | — | Upgrade libxml2 | Jan 17, 2025 | Dec 23, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 23, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub