Summary
[2.12.5-10.4]
- Fix CVE-2026-86144 (RHEL-256302)
- Fix CVE-2026-86140 (RHEL-256024)
- Fix CVE-2026-74860 (RHEL-255957)
- Fix CVE-2026-86142 (RHEL-256368)
- Fix CVE-2026-86143 (RHEL-256896)
- Fix CVE-2026-86138 (RHEL-256948)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libxml2 | 0:2.12.5-10.el10_2.4 |
| Oracle Linux · 10 | libxml2-devel | 0:2.12.5-10.el10_2.4 |
| Oracle Linux · 10 | libxml2-static | 0:2.12.5-10.el10_2.4 |
| Oracle Linux · 10 | python3-libxml2 | 0:2.12.5-10.el10_2.4 |
Vulnerabilities 6
-
High 8.5
Libxml2: double-free/uaf in libxml2 python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-fre…
-
High 8.0
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
-
Medium 6.9
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
-
Medium 6.9
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer …
-
Medium 6.9
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to …
-
Medium 5.6
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This h…