Summary
[2.9.1-6.0.13.6]
- Backport fix for CVE-2025-9714 [Orabug: 39476695]
[2.9.1-6.0.11.6]
- Fix CVE-2025-32415: Fix heap buffer overflow [Orabug: 38310750]
[2.9.1-6.0.9.6]
- Fix CVE-2025-7425: heap-use-after-free in xmlFreeID [Orabug: 38290330]
[2.9.1-6.0.7.6]
- Fix CVE-2025-6021, CVE-2025-32414, CVE-2025-49794, CVE-2025-49796
- [Orabug: 38255814]
[2.9.1-6.0.5]
- Fix CVE-2024-56171 [Orabug: 37694105]
- Fix CVE-2025-24928 [Orabug: 37694105]
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | libxml2 | 0:2.9.1-6.0.13.el7_9.6 |
| Oracle Linux · 7 | libxml2-devel | 0:2.9.1-6.0.13.el7_9.6 |
| Oracle Linux · 7 | libxml2-python | 0:2.9.1-6.0.13.el7_9.6 |
| Oracle Linux · 7 | libxml2-static | 0:2.9.1-6.0.13.el7_9.6 |
Vulnerabilities 1
-
Medium 6.2
Stack overflow in libxml2
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` wer…