PT-2024-25913 · Libxml2+6 · Libxml2+6
Richard W.M. Jones
·
Published
2024-05-13
·
Updated
2025-10-10
·
CVE-2024-34459
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
libxml2 versions prior to 2.11.8
libxml2 versions 2.12.x prior to 2.12.7
Description
An issue was discovered in xmllint, which is part of libxml2. The problem arises when formatting error messages with xmllint --htmlout, resulting in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c. This can potentially lead to a denial of service.
Recommendations
For libxml2 versions prior to 2.11.8, update to version 2.11.8 or later.
For libxml2 versions 2.12.x prior to 2.12.7, update to version 2.12.7 or later.
As a temporary workaround, consider avoiding the use of xmllint --htmlout until a patch is applied.
Exploit
Fix
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Red Os
Suse
Ubuntu
Libxml2