Release date:
2026-10-28 09:50:44 UTC
Description:
* SECURITY UPDATE: internal robustness fix in schematron report formatting
- debian/patches/libxml2-2.10.2-CVE-2025-49795.patch: check the result of
xmlXPathCompiledEval() in xmlSchematronFormatReport() before reading it,
so a report whose select expression does not compile is handled on the
existing early-exit path instead, and free the compiled expression and
the select string inside the guard so a hostile schema cannot leak once
per matching node per rule; backport of upstream 499bcb78 and its
required follow-up 24d7e159
- CVE-2025-49795
* SECURITY UPDATE: security hardening for fields shared with libxslt
- debian/patches/libxml2-2.10.2-CVE-2025-7425.patch: read xmlAttr.atype,
xmlNode.extra and xmlDoc.properties through masking accessors, so the
upper bits libxslt stores its own flags in cannot disturb libxml2's ID
bookkeeping; backport of Red Hat's c9s libxml2-2.9.13-CVE-2025-7425.patch
- CVE-2025-7425
Updated packages:
-
alt-libxml2_2.10.2-9_amd64.deb
sha:f5b68c1b19b94407659313ef63885f452c225406
-
alt-libxml2-devel_2.10.2-9_amd64.deb
sha:35ae199020ab76da08b7526a6e44605f05b300c1
-
alt-libxml2-doc_2.10.2-9_all.deb
sha:ce2e74e93a5cce37457781977f4604e3ebcb4028
-
alt-libxml2-static_2.10.2-9_amd64.deb
sha:538e48fa17f25d97c39c3a74c2a2310615fc30fa
-
alt-libxml2_2.10.2-9_arm64.deb
sha:d88e71a7119e93c9c3ff8a594a167bff9cc1ce81
-
alt-libxml2-devel_2.10.2-9_arm64.deb
sha:978e13f26ed78c8555d88f395b2f0fde80b32fe8
-
alt-libxml2-static_2.10.2-9_arm64.deb
sha:52a987efd6a5c1b5938327d26b1b9034e755c6ea
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
