High severity · published Feb 4, 2024
CVE-2024-25062
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libxml2 · Xmlsoft
before 2.11.7; 2.12.0 before 2.12.5 · source: NVD
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
SN
SINEC NMS · Siemens
before V3.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25062
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25062
Exploit
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
Release Notes
https://gitlab.gnome.org/GNOME/libxml2/-/tags
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20241018-0009/
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-784301.html
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
More from Libxml2
9.8
CVE-2026-6653
libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
9.8
CVE-2024-56171
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
9.8
CVE-2017-7375
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset…
9.8
CVE-2017-7376
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects
9.8
CVE-2017-16931
parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a…