Skip to content
OpenAdvisories
Medium ALAS2-2025-2860 2 CVEs

Moderate: libxml2 security update (Amazon Linux 2)

Published May 21, 2025 · Updated May 29, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-32415: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. CVE-2025-32414: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 libxml2 0:2.9.1-6.amzn2.5.17
Amazon Linux · 2 libxml2-debuginfo 0:2.9.1-6.amzn2.5.17
Amazon Linux · 2 libxml2-devel 0:2.9.1-6.amzn2.5.17
Amazon Linux · 2 libxml2-python 0:2.9.1-6.amzn2.5.17
Amazon Linux · 2 libxml2-static 0:2.9.1-6.amzn2.5.17

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32414.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32415.html