Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24855: numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. CVE-2024-55549: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libxslt | 0:1.1.28-6.amzn2.0.3 |
| Amazon Linux · 2 | libxslt-debuginfo | 0:1.1.28-6.amzn2.0.3 |
| Amazon Linux · 2 | libxslt-devel | 0:1.1.28-6.amzn2.0.3 |
| Amazon Linux · 2 | libxslt-python | 0:1.1.28-6.amzn2.0.3 |
Vulnerabilities 2
-
High 7.8
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
-
High 7.8
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can…