Release date:
2026-09-17 10:54:21 UTC
Description:
- CVE-2024-56171: use-after-free after xmlSchemaItemListAdd in the XML Schema
identity-constraint code (xmlSchemaIDCFillNodeTables,
xmlSchemaBubbleIDCNodeTables)
- CVE-2026-6653: use-after-free in xmlParseInternalSubset; xmlPushInput()
returned -1 for a parameter entity input it had already pushed, so the caller
freed an input stream that ctxt->input still pointed at. Reachable through the
entity amplification check carried by 2.10.2 for CVE-2021-3541, which this
keeps in place. Also guards the xmlSkipBlankChars() loop on XML_PARSER_EOF
(upstream e129c1d1), without which the same document spins at 100% CPU once
the input is no longer freed
Updated packages:
-
alt-libxml2-2.10.2-7.el7.x86_64.rpm
sha:5f05581422376f74bf7e5a70181e6a0072038012368a8a7f19d4dd32accfb525
-
alt-libxml2-devel-2.10.2-7.el7.x86_64.rpm
sha:01b5c630ca01f079eb4eb06e07e088824a9d390fbff37fd17cc17b01f68055a8
-
alt-libxml2-static-2.10.2-7.el7.x86_64.rpm
sha:aa25ffffcec70ae599a76ded2df7ec1c5b587f3c88da730d84009377f446bf3f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
