Use-after-free vulnerability in libxml2
Summary
CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. Affects libxml2 across 3 version ranges.
< 2.11.7-r0
>= 5e9b167dce73bd6a804ab107ae4c4b95e6849597, < e189e9945317ad4c8603fa2300d11d11f5e2e335
< 8711320065405c4bb08aaccd4bd2881450b5ce41
Fixed in 2.11.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a popular open-source library for parsing and manipulating XML documents. It provides various interfaces for XML processing, including the XML Reader interface. The library is widely used in many applications and frameworks. However, versions before 2.11.7 and 2.12.x before 2.12.5 of libxml2 are vulnerable to a use-after-free vulnerability when using the XML Reader interface with DTD validation and XInclude expansion enabled.
Vulnerability Detail
The use-after-free vulnerability in libxml2 occurs when processing crafted XML documents. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or potentially execute arbitrary code. The issue arises due to a use-after-free error in the xmlValidatePopElement function. An attacker can craft a malicious XML document that triggers the use-after-free condition, leading to a crash or potential code execution.
How To Fix
Minimum fixed version
2.11.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update libxml2 to the fixed version as soon as possible.
Conclusion
The use-after-free vulnerability in libxml2 can have severe consequences, including denial-of-service and potential code execution. It is highly recommended to update libxml2 to version 2.11.7 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxml2 →
FAQ
libxml2 is an open-source library for parsing and manipulating XML documents. It provides various interfaces for XML processing and is widely used in many applications and frameworks.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed. In the case of libxml2, this vulnerability can be exploited to cause a crash or potentially execute arbitrary code.
An attacker can craft a malicious XML document that triggers the use-after-free condition in libxml2. By exploiting this vulnerability, the attacker can cause a denial-of-service condition or potentially execute arbitrary code.
Yes, a fix for this vulnerability is available in libxml2 version 2.11.7 and later. It is recommended to update libxml2 to the latest fixed version to mitigate the risk.
No, there are no known workarounds for this vulnerability. It is crucial to update libxml2 to the fixed version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
