Critical Use-After-Free Vulnerability in libxml2 Affects XML Reader Interface
Summary
ALPINE-CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. Affects libxml2 versions < 2.11.7-r0. Fixed in 2.11.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML documents. It supports various features such as DTD validation and XInclude expansion, making it a critical component in many applications that handle XML data. However, certain versions of libxml2 are vulnerable to a use-after-free issue when these features are enabled, which can lead to severe security implications.
Vulnerability Detail
An issue was discovered in libxml2 before version 2.11.7 and in the 2.12.x series before version 2.12.5. The vulnerability arises when the XML Reader interface is used with DTD validation and XInclude expansion enabled. Processing specially crafted XML documents can result in a use-after-free condition in the xmlValidatePopElement function. This can potentially allow an attacker to execute arbitrary code, leading to a complete compromise of the affected system.
How To Fix
Minimum fixed version
2.11.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling DTD validation and XInclude expansion in your XML processing if possible. This can mitigate the risk of exploitation until the package is updated.
Conclusion
The libxml2 library has a critical vulnerability that can lead to severe security risks if not addressed. Users are strongly advised to update to the patched versions as soon as possible to protect their systems from potential exploitation.
See every vulnerability recorded for libxml2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of libxml2 prior to 2.11.7 and 2.12.x before 2.12.5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Yes, you can temporarily disable DTD validation and XInclude expansion in your XML processing to reduce the risk of exploitation.
More information can be found in the CVE-2024-25062 details and the Alpine Linux security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
