{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2023-28484: NULL pointer dereference in xmlSchemaFixupComplexType().\n When a complex type extends a base type by complex content, the effective\n content model is built by splicing the base type's particle in front of the\n derived type's; the splice arm walked baseType->subtypes without checking it\n is non-NULL. A base declared with simpleContent has no particle, so an\n invalid schema combining the two crashes the parser before the diagnostic\n that would reject it is emitted. Affects anything parsing an untrusted\n .xsd, xmllint --schema included. Upstream e4f85f1b (v2.10.4)\n- CVE-2023-29469: non-deterministic hashing of empty dictionary strings.\n xmlDictComputeFastKey() guarded only `name == NULL` and so, for a\n zero-length non-terminated name, read name[0] past the end of the string\n and returned the constant 0 instead of the per-dictionary seed. Upstream\n states the impact as \"various logic or memory errors, including double\n frees\": an inconsistent key makes the dictionary return the wrong answer\n for an empty name, and callers that free on it can double free. Taking the\n seed into account is secondary and, upstream's words, \"shouldn't have an\n impact on security\". Guard namelen <= 0 and return the seed. Upstream\n 547edbf1 (v2.10.4)\n- CVE-2024-34459: buffer over-read in xmlHTMLPrintFileContext() in xmllint.c.\n The function backscans from input->cur twice to render the caret line under\n an offending token; the first scan is bounded by `cur > base`, the second is\n not, so a parser position at the start of the buffer preceded by newlines\n walks off the front and keeps reading. CLI only - the function is static to\n xmllint.c and runs only under --htmlout - and a read, not a write, but we\n ship xmllint on every platform. Upstream 3ad7f816 (v2.12.7)\n- CVE-2026-0990: unbounded recursion in catalog URI resolution.\n xmlCatalogXMLResolve() has carried a MAX_CATAL_DEPTH test and matching\n depth increment for the public-identifier path for years (catalog.c:1635\n and 1641); the URI path had neither, so a delegateURI\n entry pointing back at its own catalog made xmlCatalogListXMLResolveURI()\n and xmlCatalogXMLResolveURI() recurse until the stack was exhausted. Add\n the same depth accounting, and walk a separate cursor so the decrements on\n the way out apply to the entry that was incremented. The separate\n MAX_CATAL_DEPTH test at catalog.c:1872, inside xmlCatalogXMLResolveURI(),\n has no matching increment on that path; it is not claimed to be unreachable\n in general, since xmlCatalogXMLResolve() has a non-decrementing return at\n 1830-1831 and parsed catalogs are cached globally. Upstream ac6f0fde\n (v2.15.2); 1961208e is the identical twin commit", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/el8/advisories/2026/clsa-2026_1792491149.json" } ], "tracking": { "current_release_date": "2026-10-20T10:13:25Z", "generator": { "date": "2026-10-20T10:13:25Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792491149", "initial_release_date": "2026-10-20T10:13:25Z", "revision_history": [ { "date": "2026-10-20T10:13:25Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-libxml2: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-10.el8.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-10.el8.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-10.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-10.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-10.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-10.el8.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-10.el8.x86_64", "product_id": "alt-libxml2-0:2.10.2-10.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-10.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-9.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-9.el8.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-9.el8.x86_64", "product_id": "alt-libxml2-0:2.10.2-9.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-9.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-9.el8.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-9.el8.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-9.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-9.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-7.el8.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-7.el8.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-7.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-7.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-7.el8.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-7.el8.x86_64", "product_id": "alt-libxml2-0:2.10.2-7.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-7.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-6.el8.x86_64", "product": { "name": "alt-libxml2-static-0:2.10.2-6.el8.x86_64", "product_id": "alt-libxml2-static-0:2.10.2-6.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-static@2.10.2-6.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-6.el8.x86_64", "product": { "name": "alt-libxml2-0:2.10.2-6.el8.x86_64", "product_id": "alt-libxml2-0:2.10.2-6.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2@2.10.2-6.el8?arch=x86_64&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "product": { "name": "alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "product_id": "alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libxml2-devel@2.10.2-6.el8?arch=x86_64&os_name=centos&os_version=8" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-10.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-10.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-10.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-10.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-10.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-9.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-9.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-9.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-9.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-9.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-7.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-7.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-7.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-6.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64" }, "product_reference": "alt-libxml2-static-0:2.10.2-6.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-6.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64" }, "product_reference": "alt-libxml2-0:2.10.2-6.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-6.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "relates_to_product_reference": "CentOS-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-0990", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-0990" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7519", "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-0990", "url": "https://access.redhat.com/security/cve/CVE-2026-0990" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018" } ], "release_date": "2026-01-15T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T10:12:30.992197Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149" }, { "category": "none_available", "date": "2026-01-15T15:15:00Z", "details": "Affected", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-28484", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2023-28484" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/491", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/491" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230601-0006/", "url": "https://security.netapp.com/advisory/ntap-20230601-0006/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240201-0005/", "url": "https://security.netapp.com/advisory/ntap-20240201-0005/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-625862.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-625862.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" } ], "release_date": "2023-04-24T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T10:12:30.992197Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149" }, { "category": "none_available", "date": "2023-04-24T21:15:00Z", "details": "Affected", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-34459", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2024-34459" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" } ], "release_date": "2024-05-14T15:39:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T10:12:30.992197Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149" }, { "category": "none_available", "date": "2024-05-14T15:39:00Z", "details": "Affected", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-29469", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "known_affected": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2023-29469" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/510", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/510" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html", "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230601-0006/", "url": "https://security.netapp.com/advisory/ntap-20230601-0006/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-625862.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-625862.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" } ], "release_date": "2023-04-24T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-20T10:12:30.992197Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-10.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-10.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1792491149" }, { "category": "none_available", "date": "2023-04-24T21:15:00Z", "details": "Affected", "product_ids": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-libxml2-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-devel-0:2.10.2-9.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-6.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-7.el8.x86_64", "CentOS-8:alt-libxml2-static-0:2.10.2-9.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }