{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: use-after-free after xmlSchemaItemListAdd\n - debian/patches/libxml2-2.10.2-CVE-2024-56171.patch: refresh the\n cached pointer to the duplicates array after xmlSchemaItemListAdd()\n may have reallocated it, in xmlSchemaIDCFillNodeTables and\n xmlSchemaBubbleIDCNodeTables in xmlschemas.c; backport of upstream\n libxml2 5880a9a6 (v2.12.10, v2.13.6, v2.14.0). Reachable from\n schema validation of an untrusted instance document that produces\n duplicate identity-constraint keys. The second site additionally\n checks xmlSchemaItemListAdd()'s return before refreshing the\n pointer: 2.10.2 assigns xmlRealloc()'s result straight to\n list->items, so unlike upstream it leaves it NULL on failure\n - CVE-2024-56171\n * SECURITY UPDATE: use-after-free in xmlParseInternalSubset\n - debian/patches/libxml2-2.10.2-CVE-2026-6653.patch: drop the\n post-push XML_PARSER_EOF check from xmlPushInput(), and give the\n xmlSkipBlankChars() loop an XML_PARSER_EOF guard, both in\n parser.c; backports of upstream libxml2 f19a9510 (its xmlPushInput\n hunk) and e129c1d1. xmlPushInput() tested for a halted parser only\n after inputPush() had already installed the input as ctxt->input,\n and then returned -1, so xmlParsePEReference() freed an input\n stream that ctxt->input still pointed at and a crafted DTD\n internal subset caused a heap use-after-free read in\n xmlParseInternalSubset(). With that input no longer freed the\n parser goes on to re-enter xmlSkipBlankChars(), whose loop was\n unconditional while NEXT is a no-op on a halted parser, so the\n same document would spin at 100% CPU instead of crashing; the\n guard ends the loop, matching the three other loops in the file.\n The halt comes from the entity amplification check added for\n CVE-2021-3541, which 2.10.2 carries; that check is left in place.\n The upstream fix for this CVE (463bbeec, v2.11.0) is not used: it\n appends members to the public xmlEntity and xmlParserInput\n structs, changing their size, and enforces the amplification cap\n even under XML_PARSE_HUGE\n - CVE-2026-6653", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/debian13/advisories/2026/clsa-2026_1789643023.json" } ], "tracking": { "current_release_date": "2026-09-17T11:04:23Z", "generator": { "date": "2026-09-17T11:04:23Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1789643023", "initial_release_date": "2026-09-17T11:04:23Z", "revision_history": [ { "date": "2026-09-17T11:04:23Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2024-56171, CVE-2026-6653" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 13", "product": { "name": "Debian 13", "product_id": "Debian-13", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-libxml2-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-0:2.10.2-5.amd64", "product_id": "alt-libxml2-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-devel-0:2.10.2-5.amd64", "product_id": "alt-libxml2-devel-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-devel@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-5.amd64", "product": { "name": "alt-libxml2-static-0:2.10.2-5.amd64", "product_id": "alt-libxml2-static-0:2.10.2-5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-static@2.10.2-5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-static-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-static-0:2.10.2-4.amd64", "product_id": "alt-libxml2-static-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-static@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-devel-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-devel-0:2.10.2-4.amd64", "product_id": "alt-libxml2-devel-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-devel@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-0:2.10.2-4.amd64", "product": { "name": "alt-libxml2-0:2.10.2-4.amd64", "product_id": "alt-libxml2-0:2.10.2-4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2@2.10.2-4?arch=amd64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "alt-libxml2-doc-0:2.10.2-5.all", "product": { "name": "alt-libxml2-doc-0:2.10.2-5.all", "product_id": "alt-libxml2-doc-0:2.10.2-5.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-doc@2.10.2-5?arch=all&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "alt-libxml2-doc-0:2.10.2-4.all", "product": { "name": "alt-libxml2-doc-0:2.10.2-4.all", "product_id": "alt-libxml2-doc-0:2.10.2-4.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/alt-libxml2-doc@2.10.2-4?arch=all&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-5.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" }, "product_reference": "alt-libxml2-static-0:2.10.2-5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-doc-0:2.10.2-5.all as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-doc-0:2.10.2-5.all" }, "product_reference": "alt-libxml2-doc-0:2.10.2-5.all", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-static-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-static-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-devel-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-devel-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-0:2.10.2-4.amd64 as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-0:2.10.2-4.amd64" }, "product_reference": "alt-libxml2-0:2.10.2-4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libxml2-doc-0:2.10.2-4.all as a component of Debian 13", "product_id": "Debian-13:alt-libxml2-doc-0:2.10.2-4.all" }, "product_reference": "alt-libxml2-doc-0:2.10.2-4.all", "relates_to_product_reference": "Debian-13" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-56171", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2024-56171" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/828", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/828" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/10", "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/11", "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/12", "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/13", "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/4", "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/5", "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/8", "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2025/Apr/9", "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250328-0010/", "url": "https://security.netapp.com/advisory/ntap-20250328-0010/" } ], "release_date": "2025-02-18T22:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T11:03:45.500096Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023" }, { "category": "none_available", "date": "2025-02-18T22:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-6653", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ], "known_affected": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-6653" }, { "category": "external", "summary": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260", "url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260" }, { "category": "external", "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058", "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058" } ], "release_date": "2026-06-22T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-17T11:03:45.500096Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-5.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-5.all", "Debian-13:alt-libxml2-static-0:2.10.2-5.amd64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1789643023" }, { "category": "none_available", "date": "2026-06-22T14:17:00Z", "details": "Affected", "product_ids": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:alt-libxml2-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-devel-0:2.10.2-4.amd64", "Debian-13:alt-libxml2-doc-0:2.10.2-4.all", "Debian-13:alt-libxml2-static-0:2.10.2-4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }