CVE-2024-25062
Summary
| CVE | CVE-2024-25062 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-02-04 16:15:45 UTC |
| Updated | 2026-10-15 01:17:20 UTC |
| Description | An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-416 | n/a | CWE-416 CWE-416 Use After Free
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.debian.org/debian-lts-announce/2025/02/msg00028.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| security.netapp.com/advisory/ntap-20241018-0009 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| cert-portal.siemens.com/productcert/html/ssa-794697.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| Tags · GNOME / libxml2 · GitLab | af854a3a-2127-422b-91ae-364da2661108 | gitlab.gnome.org | Release Notes |
| cert-portal.siemens.com/productcert/html/ssa-784301.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| [CVE-2024-25062] Use-after-free in xmlValidatePopElement() using XMLReader API (#604) · Issues · GNOME / libxml2 · GitLab | af854a3a-2127-422b-91ae-364da2661108 | gitlab.gnome.org | Exploit, Issue Tracking |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 200139 Ubuntu Security Notification for libxml2 Vulnerability (USN-6658-1)
- 200181 Ubuntu Security Notification for libxml2 Vulnerability (USN-6658-2)
- 510733 Alpine Linux Security Update for libxml2
- 510791 Alpine Linux Security Update for qt6-qtwebengine
- 674120 EulerOS Security Update for libxml2 (EulerOS-SA-2024-1489)
- 674124 EulerOS Security Update for libxml2 (EulerOS-SA-2024-1510)
- 691448 Free Berkeley Software Distribution (FreeBSD) Security Update for electron{27,28} (e74da31b-276a-4a22-9772-17dd42b97559)
- 710860 Gentoo Linux libxml2 Multiple Vulnerabilities (GLSA 202402-11)
- 755744 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2024:0461-1)
- 755794 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2024:0556-1)
- 755795 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2024:0555-1)
- 755836 SUSE Enterprise Linux Security Update for libxml2 (SUSE-SU-2024:0613-1)