Описание
Security update for libxml2
This update for libxml2 fixes the following issues:
- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in
xmlCatalogXMLResolveURI. (bsc#1256807, bsc#1256811) - CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
- CVE-2026-1757: Fixed a memory leak in the
xmllintinteractive shell. (bsc#1257594, bsc#1257595) - CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
- CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858)
- CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)
Список пакетов
Container private-registry/harbor-portal:latest
Image SLES15-SP7-CHOST-BYOS-Aliyun
Image SLES15-SP7-CHOST-BYOS-Azure
Image SLES15-SP7-CHOST-BYOS-EC2
Image SLES15-SP7-CHOST-BYOS-GCE
Image SLES15-SP7-CHOST-BYOS-GDC
Image SLES15-SP7-CHOST-BYOS-SAP-CCloud
Image SLES15-SP7-HPC-BYOS-EC2
Image SLES15-SP7-SAP-BYOS-EC2
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Python 3 15 SP7
Ссылки
- Link for SUSE-SU-2026:0605-1
- E-Mail link for SUSE-SU-2026:0605-1
- SUSE Security Ratings
- SUSE Bug 1247850
- SUSE Bug 1247858
- SUSE Bug 1250553
- SUSE Bug 1256804
- SUSE Bug 1256805
- SUSE Bug 1256807
- SUSE Bug 1256808
- SUSE Bug 1256809
- SUSE Bug 1256810
- SUSE Bug 1256811
- SUSE Bug 1256812
- SUSE Bug 1257593
- SUSE Bug 1257594
- SUSE Bug 1257595
- SUSE CVE CVE-2025-10911 page
- SUSE CVE CVE-2025-8732 page
- SUSE CVE CVE-2026-0989 page
Описание
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
Затронутые продукты
Ссылки
- CVE-2025-10911
- SUSE Bug 1250553
Описание
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
Затронутые продукты
Ссылки
- CVE-2025-8732
- SUSE Bug 1247850
Описание
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Затронутые продукты
Ссылки
- CVE-2026-0989
- SUSE Bug 1256804
Описание
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Затронутые продукты
Ссылки
- CVE-2026-0990
- SUSE Bug 1256806
Описание
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Затронутые продукты
Ссылки
- CVE-2026-0992
- SUSE Bug 1256808
Описание
A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
Затронутые продукты
Ссылки
- CVE-2026-1757
- SUSE Bug 1257593