[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <8CED60C5-6E49-42C3-A517-33E02F74F7DE@aevum.de>
Date: Thu, 17 Apr 2025 14:34:40 +0200
From: Nick Wellnhofer <wellnhofer@...um.de>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in libxml2
These issues are fixed in 2.14.2 and 2.13.8. Older branches won't receive official updates.
[CVE-2025-32414] Buffer overflow when parsing text streams with Python API
https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
The Python Package Index contains an outdated and unsanctioned upload based on libxml2 2.9.5 which is vulnerable. I tried to inform the PyPI maintainers but I'm not sure my message made it through.
[CVE-2025-32415] Heap-based Buffer Overflow in xmlSchemaIDCFillNodeTables
https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
Nick
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
