Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Libxml2 Library Security Update for Red Hat Products

published 1 year ago

Summary

A security update is available for the libxml2 library used in Red Hat products, which could allow an attacker to execute arbitrary code on a vulnerable system. This update is recommended for all users to ensure the security of their systems. Users should apply the update as soon as possible to fix the issue.

What to do

Update redhat libxml2 to version 0:2.9.13-10.el9_4.
Update redhat libxml2-debuginfo to version 0:2.9.13-10.el9_4.
Update redhat libxml2-debugsource to version 0:2.9.13-10.el9_4.
Update redhat libxml2-devel to version 0:2.9.13-10.el9_4.
Update redhat python3-libxml2 to version 0:2.9.13-10.el9_4.
Update redhat python3-libxml2-debuginfo to version 0:2.9.13-10.el9_4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:9.4::appstream	redhat	libxml2	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	libxml2-debuginfo	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	libxml2-debugsource	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	libxml2-devel	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	python3-libxml2	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::appstream	redhat	python3-libxml2-debuginfo	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	libxml2	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	libxml2-debuginfo	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	libxml2-debugsource	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	libxml2-devel	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	python3-libxml2	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4
Red Hat:rhel_eus:9.4::baseos	redhat	python3-libxml2-debuginfo	< 0:2.9.13-10.el9_4 Fix: upgrade to 0:2.9.13-10.el9_4

Original advisory text

Red Hat Security Advisory: libxml2 security update

References

https://access.redhat.com/errata/RHSA-2025:11580 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372373 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372385 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372406 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11580.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-6021 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-6021 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6021 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/926 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-49794 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-49794 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49794 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/931 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-49796 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-49796 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49796 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/933 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

9.1 Critical

Timeline

Published23 Jul 2025

Updated21 Mar 2026

First seen21 Mar 2026

Sources

RHSA-2025:11580 · OSV

Track software like this

Free during beta