Important: libxml2 security update (Oracle Linux 8)

Summary

Fixed packages 3

Vulnerabilities 5

• High 8.5
  CVE-2026-74860

  Libxml2: double-free/uaf in libxml2 python bindings

  A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-fre…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Sep 8, 2026
• High 8.0
  CVE-2026-86140

  In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 6.9
  CVE-2026-86138

  In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 6.9
  CVE-2026-86143

  In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to …

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026
• Medium 5.6
  CVE-2026-86144

  In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This h…

  xmlsoft libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux
  Sep 5, 2026