Skip to content
OpenAdvisories
Medium ALAS2023-2025-963 2 CVEs

Moderate: libxml2 security update (Amazon Linux 2023)

Published May 7, 2025 · Updated May 13, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32415: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. CVE-2025-32414: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 libxml2 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 libxml2-debuginfo 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 libxml2-debugsource 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 libxml2-devel 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 libxml2-static 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 python3-libxml2 0:2.10.4-1.amzn2023.0.10
Amazon Linux · 2023 python3-libxml2-debuginfo 0:2.10.4-1.amzn2023.0.10

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32414.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32415.html