Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-24855: numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. CVE-2024-55549: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libxslt | 0:1.1.43-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libxslt-debuginfo | 0:1.1.43-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libxslt-debugsource | 0:1.1.43-1.amzn2023.0.1 |
| Amazon Linux · 2023 | libxslt-devel | 0:1.1.43-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-libxslt | 0:1.1.43-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3-libxslt-debuginfo | 0:1.1.43-1.amzn2023.0.1 |
Vulnerabilities 2
-
High 7.8
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
-
High 7.8
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can…