CVE-2024-25062CWE-416

CVE-2024-25062

High · published February 4, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01314 · 70.5th percentile
Weakness
CWE-416 · Use After Free
Published
2024-02-04T21:15Z
Affected products (2)
ProductVersionsFixed in
xmlsoft/libxml2< 2.11.72.11.7
xmlsoft/libxml2≥ 2.12.0, < 2.12.52.12.5
References (8)
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 · [email protected]https://gitlab.gnome.org/GNOME/libxml2/-/tags · [email protected]https://gitlab.gnome.org/GNOME/libxml2/-/issues/604 · af854a3a-2127-422b-91ae-364da2661108https://gitlab.gnome.org/GNOME/libxml2/-/tags · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20241018-0009/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-784301.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 04 FEB 00:00Z
    An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5
    cvelistv5