Release date:
2026-10-28 15:39:40 UTC
Description:
* SECURITY UPDATE: internal robustness fix in schematron report formatting
- debian/patches/libxml2-2.10.2-CVE-2025-49795.patch: check the result of
xmlXPathCompiledEval() in xmlSchematronFormatReport() before reading it,
so a report whose select expression does not compile is handled on the
existing early-exit path instead, and free the compiled expression and
the select string inside the guard so a hostile schema cannot leak once
per matching node per rule; backport of upstream 499bcb78 and its
required follow-up 24d7e159
- CVE-2025-49795
* SECURITY UPDATE: security hardening for fields shared with libxslt
- debian/patches/libxml2-2.10.2-CVE-2025-7425.patch: read xmlAttr.atype,
xmlNode.extra and xmlDoc.properties through masking accessors, so the
upper bits libxslt stores its own flags in cannot disturb libxml2's ID
bookkeeping; backport of Red Hat's c9s libxml2-2.9.13-CVE-2025-7425.patch
- CVE-2025-7425
Updated packages:
-
alt-libxml2_2.10.2-9_amd64.deb
sha:89896baeb1c9ac954ee265448c183b430085f82a
-
alt-libxml2-devel_2.10.2-9_amd64.deb
sha:2ca30a143511af8537bce86b5c354922b9b195b6
-
alt-libxml2-doc_2.10.2-9_all.deb
sha:95883b2310cf5b1a470c76b8163c7964936fdecc
-
alt-libxml2-static_2.10.2-9_amd64.deb
sha:83f4b182122153b1c330d11341735aa0a2cb6ff8
-
alt-libxml2_2.10.2-9_arm64.deb
sha:e3ec2f086b05ddf784308a20ce283953f223f16f
-
alt-libxml2-devel_2.10.2-9_arm64.deb
sha:d89f608f388855e9bd4c00088bcb460427e9eeb5
-
alt-libxml2-static_2.10.2-9_arm64.deb
sha:faa18f6adabe698b76a3aaaa282a9de6e46be6f1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
