Red Hat Bug Fix Advisory: libxml2 and libxslt bug fix and enhancement update

Fixed packages 4

Vulnerabilities 2

• High 7.8
  CVE-2025-7425

  Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

  A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attr…

  Red Hat GNOME Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Wolfi
  Jul 10, 2025
• High 7.5
  CVE-2025-7424

  Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

  A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In…

  Red Hat GNOME Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Jul 10, 2025

References

• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_12345.json
• report
  https://access.redhat.com/security/cve/CVE-2025-7424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379228
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-7424
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-7424
• article
  https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
• report
  https://access.redhat.com/security/cve/CVE-2025-7425
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379274
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-7425
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-7425
• article
  https://gitlab.gnome.org/GNOME/libxslt/-/issues/140