VDB
RHSA-2025%3A13622
RHSA-2025%3A13622
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:d9b89779a57f1763bca3e68867447faa25da1846ffeae626309a1756b45d210a_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-ingester-rhel8@sha256:d9b89779a57f1763bca3e68867447faa25da1846ffeae626309a1756b45d210a_amd64 |
| Red Hat | registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8@sha256:57ef3d922681abc67745773f5f7232b23038767b05b5b4c713c3b5089ea9e295_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-operator-bundle@sha256:264613b2add0f32e5f537ee7cf9ba8019e5e9a347fdf20bc3de8d1678157ba66_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-operator-bundle@sha256:264613b2add0f32e5f537ee7cf9ba8019e5e9a347fdf20bc3de8d1678157ba66_amd64 |
| Red Hat | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:a3e7ac42823a2f58d15b52b5c729ae34f3e119122fb4defae4754e6ab14dabcd_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:9a17a95797aa5ec5252ea801a4962d1a6a903facafe79dcc321a54fadfa9fee3_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:802a78aa94df0a14b8a0ddd350e128141ebc0b8c18730b7a54947ba7431d6bc2_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:43ce372ddc2de4dc633322ec84fca9927d5a6649068f58cfaa238de39d03a0d2_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:9b7a37d182cfba30af3697887ee7c4faa3768f600dd6ec7dc35be26eba9b123d_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:9b7a37d182cfba30af3697887ee7c4faa3768f600dd6ec7dc35be26eba9b123d_s390x |
| Red Hat | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:6f387ea61bf4d0c11c8fadd8225d2eca24d19e28d596afa800149925154a345a_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:deb807f053dacbbea6e950e13ee123bb8b9184e0d8eca0d04d5e8f48d3ef6a95_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-es-index-cleaner-rhel8@sha256:deb807f053dacbbea6e950e13ee123bb8b9184e0d8eca0d04d5e8f48d3ef6a95_arm64 |
| Red Hat | registry.redhat.io/rhosdt/jaeger-es-rollover-rhel8@sha256:39b2d56b8f0eb3b539697fc387ae84230182c7e8cf5c184b8ee6c02e29386120_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:2a359b16651cf20b9e37faabc6f57753744c59103979670260e263df2857da47_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:2509c7cc0bdf6d001442d2e83e21925b09a59c4b05eef81e98af93327f6f6c6d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:593c9e2656e624b444bd45740c6e556c06137ab6cf7aaa0387799b10669b74e9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:593c9e2656e624b444bd45740c6e556c06137ab6cf7aaa0387799b10669b74e9_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:2a359b16651cf20b9e37faabc6f57753744c59103979670260e263df2857da47_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-query-rhel8@sha256:43ce372ddc2de4dc633322ec84fca9927d5a6649068f58cfaa238de39d03a0d2_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-operator-bundle@sha256:264613b2add0f32e5f537ee7cf9ba8019e5e9a347fdf20bc3de8d1678157ba66_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:ef10956a206329b8213fb31855fbcc849d00e1e44adb307985009be2bfdb966e_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/jaeger-agent-rhel8@sha256:ef10956a206329b8213fb31855fbcc849d00e1e44adb307985009be2bfdb966e_arm64 |
| Red Hat | registry.redhat.io/rhosdt/jaeger-rhel8-operator@sha256:dc1731fd9e662d103f60a097833260adb9bbeb94b401281d9c65169e5db86bf8_s390x as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
| Red Hat | registry.redhat.io/rhosdt/jaeger-collector-rhel8@sha256:8b7e39460aebbd3bcefa9383c2d1f3df0d5dd57ee306ce89550fb8c46721819b_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.3 | * |
…and 46 more
Timeline
- Aug 11, 2025 CVE Published
- Aug 23, 2026 CVE Updated
- Aug 23, 2026 Distribution Patch
- Aug 23, 2026 Distribution Patch
- Aug 23, 2026 Security Advisory
- Aug 23, 2026 Security Advisory
- Aug 23, 2026 Security Advisory
- Aug 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2025:13622 advisory
- https://access.redhat.com/security/cve/CVE-2025-32415 advisory
- https://access.redhat.com/security/cve/CVE-2025-7425 advisory
- https://access.redhat.com/security/cve/CVE-2025-8058 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-jaeger advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13622.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2379274 issue
- https://www.cve.org/CVERecord?id=CVE-2025-7425 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-7425 advisory
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/140 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2383146 issue
- https://www.cve.org/CVERecord?id=CVE-2025-8058 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-8058 advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=33185 issue
- https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2360768 issue
- https://www.cve.org/CVERecord?id=CVE-2025-32415 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-32415 advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/890 advisory