Alpine Linux Development TeamALPINE:CVE-2024-25062

HistoryFeb 04, 2024 - 4:15 p.m.

CVE-2024-25062

2024-02-0416:15:45

Alpine Linux Development Team

security.alpinelinux.org

cve-2024-25062

issue discovered

libxml2

xml reader

dtd validation

xinclude expansion

crafted xml documents

xmlvalidatepopelement

unix

6.8 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

16.6%

JSON

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

OSVersionArchitecturePackageVersionFilename
Alpine3.17-mainnoarchlibxml2= 2.10.4-r0UNKNOWN
Alpine3.16-mainnoarchlibxml2= 2.9.14-r2UNKNOWN
Alpineedge-communitynoarchqt6-qtwebengine< 6.6.3-r1UNKNOWN
Alpineedge-mainnoarchlibxml2< 2.12.5-r0UNKNOWN
Alpine3.18-mainnoarchlibxml2< 2.11.7-r0UNKNOWN
Alpine3.19-communitynoarchqt6-qtwebengine< 6.6.1-r9UNKNOWN
Alpine3.19-mainnoarchlibxml2< 2.11.7-r0UNKNOWN
Alpine3.20-communitynoarchqt6-qtwebengine< 6.6.3-r1UNKNOWN
Alpine3.20-mainnoarchlibxml2< 2.12.5-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.17-main	noarch	libxml2	= 2.10.4-r0	UNKNOWN
Alpine	3.16-main	noarch	libxml2	= 2.9.14-r2	UNKNOWN
Alpine	edge-community	noarch	qt6-qtwebengine	< 6.6.3-r1	UNKNOWN
Alpine	edge-main	noarch	libxml2	< 2.12.5-r0	UNKNOWN
Alpine	3.18-main	noarch	libxml2	< 2.11.7-r0	UNKNOWN
Alpine	3.19-community	noarch	qt6-qtwebengine	< 6.6.1-r9	UNKNOWN
Alpine	3.19-main	noarch	libxml2	< 2.11.7-r0	UNKNOWN
Alpine	3.20-community	noarch	qt6-qtwebengine	< 6.6.3-r1	UNKNOWN
Alpine	3.20-main	noarch	libxml2	< 2.12.5-r0	UNKNOWN