Bug 1219576 - VUL-0: CVE-2024-25062: libxml2,libxml2-python,python-libxml2,python-libxml2-python: use-after-free in XMLReader
Summary: VUL-0: CVE-2024-25062: libxml2,libxml2-python,python-libxml2,python-libxml2-p...
Status: IN_PROGRESS
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/392982/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-25062
  Show dependency tree / graph
 
Reported: 2024-02-05 14:55 UTC by Andrea Mattiazzo
Modified: 2024-06-10 20:30 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andrea Mattiazzo 2024-02-05 14:55:02 UTC 
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-25062
https://gitlab.gnome.org/GNOME/libxml2/-/tags
https://www.cve.org/CVERecord?id=CVE-2024-25062
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
https://bugzilla.redhat.com/show_bug.cgi?id=2262726

Patch:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a66b176055d25ee635bf328c7b35b381db0b71d
Comment 1 Andrea Mattiazzo 2024-02-05 14:58:29 UTC 
Tracking as affected:
- SUSE:ALP:Source:Standard:1.0/libxml2
- SUSE:Carwos:1/libxml2
- SUSE:SLE-12-SP2:Update/libxml2
- SUSE:SLE-15-SP4:Update/libxml2       
- SUSE:SLE-15-SP5:Update/libxml2     
- SUSE:SLE-15:Update/libxml2
- openSUSE:Factory/libxml2   

- SUSE:SLE-15:Update/python-libxml2-python

- SUSE:SLE-12-SP2:Update/python-libxml2
Comment 5 David Anes 2024-02-10 12:10:16 UTC 
Codestream                   Vers.  Request
----------------------------------------------------------------------------
openSUSE:Factory             2.12.2 https://build.opensuse.org/request/show/1145592
Comment 6 David Anes 2024-02-10 12:23:24 UTC 
(In reply to David Anes from comment #5)
> Codestream                   Vers.  Request
> ----------------------------------------------------------------------------
> openSUSE:Factory             2.12.2
> https://build.opensuse.org/request/show/1145592

Sorry, that one was for the devel project. For current openSUSE:Factory:

Codestream                   Vers.  Request
----------------------------------------------------------------------------
openSUSE:Factory             2.11.6 https://build.opensuse.org/request/show/1145598
Comment 7 Maintenance Automation 2024-02-13 16:30:06 UTC 
SUSE-SU-2024:0461-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1219576
CVE References: CVE-2024-25062
Sources used:
SUSE Linux Enterprise Micro 5.2 (src): libxml2-2.9.7-150000.3.66.1, python-libxml2-python-2.9.7-150000.3.66.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): libxml2-2.9.7-150000.3.66.1, python-libxml2-python-2.9.7-150000.3.66.1
openSUSE Leap 15.5 (src): python-libxml2-python-2.9.7-150000.3.66.1
SUSE Linux Enterprise Micro 5.1 (src): libxml2-2.9.7-150000.3.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Maintenance Automation 2024-02-20 20:30:12 UTC 
SUSE-SU-2024:0556-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1219576
CVE References: CVE-2024-25062
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): libxml2-2.9.4-46.71.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): libxml2-2.9.4-46.71.1, python-libxml2-2.9.4-46.71.1
SUSE Linux Enterprise Server 12 SP5 (src): libxml2-2.9.4-46.71.1, python-libxml2-2.9.4-46.71.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): libxml2-2.9.4-46.71.1, python-libxml2-2.9.4-46.71.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Maintenance Automation 2024-02-20 20:30:13 UTC 
SUSE-SU-2024:0555-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1219576
CVE References: CVE-2024-25062
Sources used:
openSUSE Leap 15.5 (src): libxml2-python-2.10.3-150500.5.14.1, libxml2-2.10.3-150500.5.14.1
SUSE Linux Enterprise Micro 5.5 (src): libxml2-python-2.10.3-150500.5.14.1, libxml2-2.10.3-150500.5.14.1
Basesystem Module 15-SP5 (src): libxml2-python-2.10.3-150500.5.14.1, libxml2-2.10.3-150500.5.14.1
Python 3 Module 15-SP5 (src): libxml2-python-2.10.3-150500.5.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-02-26 12:36:16 UTC 
SUSE-SU-2024:0613-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1219576
CVE References: CVE-2024-25062
Sources used:
openSUSE Leap 15.4 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
openSUSE Leap Micro 5.3 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
openSUSE Leap Micro 5.4 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro 5.3 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro 5.4 (src): libxml2-python-2.9.14-150400.5.28.1, libxml2-2.9.14-150400.5.28.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Maintenance Automation 2024-05-29 08:30:05 UTC 
SUSE-SU-2024:0461-2: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1219576
CVE References: CVE-2024-25062
Maintenance Incident: [SUSE:Maintenance:32556](https://smelt.suse.de/incident/32556/)
Sources used:
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Enterprise Storage 7.1 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
openSUSE Leap 15.5 (src):
 python-libxml2-python-2.9.7-150000.3.66.1
SUSE Linux Enterprise Micro 5.1 (src):
 libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise Micro 5.2 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 python-libxml2-python-2.9.7-150000.3.66.1, libxml2-2.9.7-150000.3.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Maintenance Automation 2024-06-10 20:30:29 UTC 
SUSE-SU-2024:0613-2: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1219576
CVE References: CVE-2024-25062
Maintenance Incident: [SUSE:Maintenance:32555](https://smelt.suse.de/incident/32555/)
Sources used:
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
openSUSE Leap 15.4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
openSUSE Leap Micro 5.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
openSUSE Leap Micro 5.4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro 5.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Micro 5.4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Manager Proxy 4.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Manager Retail Branch Server 4.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1
SUSE Manager Server 4.3 (src):
 libxml2-2.9.14-150400.5.28.1, libxml2-python-2.9.14-150400.5.28.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.