PT-2025-1376 · Libxml2+11 · Libxml2+11

Published 2025-01-26 · Updated 2025-10-07 · CVE-2022-49043

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The libxml2 library, specifically versions up to 2.10.x, contains a use-after-free flaw in the xmlXIncludeAddNode function within the xinclude.c file. This flaw can potentially lead to remote code execution. The affected versions are all libxml2 versions before 2.11.0. An exploit for this issue is available, allowing for potential remote code execution. It is recommended to update libxml2 to version 2.11.0 or later to prevent potential remote code execution. More information about this issue can be found at https://t.co/PiPDOx4jnd and https://t.co/NOrljIDevR. #libxml2 #xmlXIncludeAddNode #useafterfree #remoteCodeExecution #InfoSec #CriticalVulnerability #libxml2vulnerability #xmlvulnerability

Fix

DoS

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025:1350

ALSA-2025:1517

AZL-55967

BDU:2025-11749

CESA-2025_1517

CVE-2022-49043

DLA-4064-1

DSA-5949-1

ECHO-FD8A-6039-C2C3

INFSA-2025_1350

INFSA-2025_1517

MGASA-2025-0034

OESA-2025-1104

OPENSUSE-SU-2025_0303-1

OPENSUSE-SU-2025_0341-1

OPENSUSE-SU-2025_0348-1

RHSA-2025:1350

RHSA-2025:1516

RHSA-2025:1517

RHSA-2025:2507

RHSA-2025:2678

RHSA-2025_1350

RHSA-2025_1517

RLSA-2025:1517

SUSE-SU-2025:0300-1

SUSE-SU-2025:0303-1

SUSE-SU-2025:0341-1

SUSE-SU-2025:0348-1

SUSE-SU-2025_0300-1

SUSE-SU-2025_0303-1

SUSE-SU-2025_0341-1

SUSE-SU-2025_0348-1

USN-7240-1

USN-7302-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libxml2

References · 75

• https://osv.dev/vulnerability/SUSE-SU-2025:0341-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49043 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE56 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49043 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:1517 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b · Patch
• https://linux.oracle.com/errata/ELSA-2025-1517.html · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-1517.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49043 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24928 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-27113 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/721260 · Security Note