CVE-2025-8732libxml2 xmlcatalog xmlParseSGMLCatalog recursion

Açıklama

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• VDB-319228 | libxml2 xmlcatalog xmlParseSGMLCatalog recursion vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
• VDB-319228 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredThird Party Advisory
• Submit #622285 | LibXML2 xmlcatalog the newest master stack overflow third-party-advisoryPermissions RequiredThird Party Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 issue-trackingExploitIssue TrackingThird Party Advisory
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853 issue-trackingExploitIssue TrackingThird Party Advisory
• https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link exploitBroken Link
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html Third Party Advisory