[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <3795e233-cb87-4396-9f15-cb244b46f9ff@oracle.com>
Date: Fri, 11 Jul 2025 14:08:18 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: 5 security issues disclosed in libxml2
On 6/16/25 15:12, Alan Coopersmith wrote:
> BTW, users of libxml2 may also be using its sibling project, libxslt,
> which currently has no active maintainer, but has three unfixed security issues
> reported against it according to
> https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt
2 of the 3 have now been disclosed:
(CVE-2025-7424) libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes
https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
https://project-zero.issues.chromium.org/issues/409761909
(CVE-2025-7425) libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption
https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
https://project-zero.issues.chromium.org/issues/410569369
Engineers from Apple & Google have proposed patches in the GNOME gitlab issues,
but neither has had a fix applied to the git repo since there is currently no
maintainer for libxslt.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
