Critical Use-After-Free Vulnerability in libxml2 Affects Multiple Debian Versions
Summary
DEBIAN-CVE-2024-25062: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. Affects libxml2 versions < 2.9.10+dfsg-6.7+deb11u6. Fixed in 2.9.10+dfsg-6.7+deb11u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a variety of functionalities for processing XML documents. It is known for its performance and compliance with XML standards. The library is utilized in many applications and systems, making it a critical component in software development. However, a recent vulnerability has been identified that affects its XML Reader interface when DTD validation and XInclude expansion are enabled.
Vulnerability Detail
An issue was discovered in libxml2 before version 2.11.7 and in the 2.12.x series before version 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free condition in the xmlValidatePopElement function. This vulnerability can potentially allow attackers to execute arbitrary code or cause a denial of service, posing significant risks to applications relying on this library.
How To Fix
Minimum fixed version
2.9.10+dfsg-6.7+deb11u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling DTD validation and XInclude expansion in your application to mitigate the risk associated with this vulnerability. This can typically be done by adjusting the configuration settings in your XML processing code.
Conclusion
The identified use-after-free vulnerability in libxml2 poses significant risks to applications that utilize this library. It is crucial for users to update to the patched versions as soon as possible to mitigate these risks. Additionally, employing workarounds can provide temporary relief until updates can be applied.
See every vulnerability recorded for libxml2 →
FAQ
The vulnerability is a use-after-free issue that occurs when processing crafted XML documents with DTD validation and XInclude expansion enabled.
Versions of libxml2 before 2.11.7 and 2.12.x before 2.12.5 are affected by this vulnerability.
Exploitation of this vulnerability could lead to arbitrary code execution or denial of service in applications using the affected versions of libxml2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
As a temporary measure, disable DTD validation and XInclude expansion in your XML processing to reduce the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
