VDB

CVE-2024-25062

CVE-2024-25062 PUBLISHED CVSS 7.5 HIGH

Reported by mitre · Published February 4, 2024

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
openjdk-8-openj9Chainguard0.53.0-r1
qt6-qtwebengineAlpine6.6.3-r1, 6.6.1-r9
openjdk-26-openj9Chainguard0.59.0-r1
openjdk-21-openj9Chainguard0.48.0-r2
openjdk-25-openj9Chainguard0.59.0-r1
openjdk-17-openj9Chainguard0.53.0-r0
openjdk-11-openj9Chainguard0.53.0-r0
SIMATIC S7-1500 TM MFP - GNU/Linux subsystemSiemens1.1

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
n/an/an/a
chainguardopenjdk-8-openj90
alpineqt6-qtwebengine0, 0
chainguardopenjdk-26-openj90
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem0
chainguardopenjdk-21-openj90
chainguardopenjdk-25-openj90
chainguardopenjdk-17-openj90
chainguardopenjdk-11-openj90
n/an/a*
ConanCenterlibxml20, 2.12.0
SiemensSINEC NMS0
alpinelibxml20, 0

Timeline

  • Feb 4, 2024 CVE Published
  • Feb 8, 2024 EPSS Score (30 in total, the first dated here)
  • Oct 4, 2024 Coalition ESS Score (11 in total, the first dated here)
  • Mar 17, 2026 Security Advisory (95 in total, the first dated here)
  • Aug 10, 2026 Distribution Patch (80 in total, the first dated here)
  • Aug 11, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-25062
vulnetix vdb fixes CVE-2024-25062

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-25062/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›