6.2Mittel
CVE-2025-9714Stack overflow in libxml2
Beschreibung
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
Schwachstellentyp (CWE):
CWE-674
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| libxml2 | libxml2 | < 2.10.0, < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, < 2.9.14+dfsg-1.3ubuntu3.5, < 2.9.13+dfsg-1ubuntu0.9, < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, < 2.9.4+dfsg1-6.1ubuntu1.9+esm5, < 2.9.3+dfsg1-1ubuntu0.7+esm10, < 2.9.1+dfsg1-3ubuntu4.13+esm9 | |
| Siemens | RUGGEDCOM ROX MX5000 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX MX5000RE | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1400 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1500 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1501 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1510 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1511 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1512 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1524 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX1536 | < V2.17.1 | |
| Siemens | RUGGEDCOM ROX RX5000 | < V2.17.1 | |
| xmlsoft | libxml2 | < 2.10.0 |
Referenzen und Patches
CPE-Treffer (NVD) (1)
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*< 2.10.0