Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Libxslt Update Fixes Critical Security Flaw in Open-Source XML Parser

published 1 year ago

Summary

A critical security issue has been fixed in the libxslt library, a popular open-source tool used for XML parsing and transformation. This issue could allow an attacker to execute malicious code on a system that uses libxslt. To ensure your system is secure, apply the latest update for libxslt as soon as possible.

What to do

Update redhat libxslt to version 0:1.1.32-8.el8_4.
Update redhat libxslt-debuginfo to version 0:1.1.32-8.el8_4.
Update redhat libxslt-debugsource to version 0:1.1.32-8.el8_4.
Update redhat libxslt-devel to version 0:1.1.32-8.el8_4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.4::appstream	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::appstream	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::appstream	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::appstream	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::appstream	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::appstream	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::appstream	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::appstream	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::appstream	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::appstream	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::appstream	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::appstream	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::baseos	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::baseos	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::baseos	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_aus:8.4::baseos	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::baseos	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::baseos	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::baseos	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_e4s:8.4::baseos	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::baseos	redhat	libxslt	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::baseos	redhat	libxslt-debuginfo	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::baseos	redhat	libxslt-debugsource	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4
Red Hat:rhel_tus:8.4::baseos	redhat	libxslt-devel	< 0:1.1.32-8.el8_4 Fix: upgrade to 0:1.1.32-8.el8_4

Original advisory text

Red Hat Security Advisory: libxslt security update

References

https://access.redhat.com/errata/RHSA-2025:3626 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2352483 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2352484 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3626.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-55549 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-55549 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-55549 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxslt/-/issues/127 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2025-24855 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-24855 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-24855 Vendor Advisory
https://gitlab.gnome.org/GNOME/libxslt/-/issues/128 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Timeline

Published7 Apr 2025

Updated25 Mar 2026

First seen25 Mar 2026

Sources

RHSA-2025:3626 · OSV

Track software like this

Free during beta