IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.8High

CVE-2025-7425Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

GNOME libxml2; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8 Published: (1 year ago)

Description

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Weakness (CWE): CWE-416

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
cert manager 1.16 —
discovery 2 —
enterprise linux 8 —
enterprise linux 9 —
GNOME libxml2 < 2.15.2
insights proxy 1.5 —
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift compliance operator 1 —
openshift distributed tracing 3.5 —
openshift file integrity operator 1 —
openshift serverless 1.36 —
Red Hat cert-manager operator for Red Hat OpenShift 1.16 all versions
Red Hat OpenShift Compliance Operator 1 all versions
Red Hat OpenShift File Integrity Operator - FIO 1 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
Red Hat Red Hat Hardened Images all versions
Red Hat Red Hat Insights proxy 1.5 all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat OpenShift Container Platform 4.13 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.18 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift distributed tracing 3.5.3 all versions
Red Hat Red Hat Web Terminal 1.11 on RHEL 9 all versions
Red Hat Red Hat Web Terminal 1.12 on RHEL 9 all versions
Red Hat RHOSS-1.36-RHEL-8 all versions
rhel aus 8.2 —
rhel aus 8.4 —
rhel aus 8.6 —
rhel e4s 8.6 —
rhel e4s 8.8 —
rhel e4s 9.0 —
rhel e4s 9.2 —
rhel eus 9.4 —
rhel eus long life 8.4 —
rhel tus 8.6 —
rhel tus 8.8 —
Siemens RUGGEDCOM ROX MX5000 < V2.17.1
Siemens RUGGEDCOM ROX MX5000RE < V2.17.1
Siemens RUGGEDCOM ROX RX1400 < V2.17.1
Siemens RUGGEDCOM ROX RX1500 < V2.17.1
Siemens RUGGEDCOM ROX RX1501 < V2.17.1
Siemens RUGGEDCOM ROX RX1510 < V2.17.1
Siemens RUGGEDCOM ROX RX1511 < V2.17.1
Siemens RUGGEDCOM ROX RX1512 < V2.17.1
Siemens RUGGEDCOM ROX RX1524 < V2.17.1
Siemens RUGGEDCOM ROX RX1536 < V2.17.1
Siemens RUGGEDCOM ROX RX5000 < V2.17.1
Siemens SIMATIC CN 4100 < V5.0
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem < V1.1.1
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
webterminal 1.11 —
webterminal 1.12 —

References and patches

Recent CVEs in the same product — Red Hat Enterprise Linux

5.5Medium
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8High
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…