Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

libxml2 Denial of Service and Data Corruption Risk

published 3 months ago

Summary

A security update for libxml2 is available to prevent denial of service attacks and data corruption. This issue affects systems that use the `xmlcatalog` utility, particularly when run in a specific mode. To protect your system, apply the latest security update.

What to do

Update suse libxml2 to version 2.13.8-160000.5.1.
Update suse libxml2-python to version 2.13.8-160000.5.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
SUSE:Linux Enterprise Server for SAP applications 16.0	suse	libxml2	< 2.13.8-160000.5.1 Fix: upgrade to 2.13.8-160000.5.1
SUSE:Linux Enterprise Server for SAP applications 16.0	suse	libxml2-python	< 2.13.8-160000.5.1 Fix: upgrade to 2.13.8-160000.5.1
SUSE:Linux Enterprise Server 16.0	suse	libxml2	< 2.13.8-160000.5.1 Fix: upgrade to 2.13.8-160000.5.1
SUSE:Linux Enterprise Server 16.0	suse	libxml2-python	< 2.13.8-160000.5.1 Fix: upgrade to 2.13.8-160000.5.1

Original advisory text

Security update for libxml2

This update for libxml2 fixes the following issues

- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).

References

https://www.suse.com/support/update/announcement/2026/suse-su-202622636-1/ Vendor Advisory
https://bugzilla.suse.com/1262719 Third Party Advisory
https://bugzilla.suse.com/1269790 Third Party Advisory
https://www.suse.com/security/cve/CVE-2026-11979 URL
https://www.suse.com/security/cve/CVE-2026-6732 URL

Timeline

Published13 Jul 2026

Updated17 Jul 2026

First seen17 Jul 2026

Sources

SUSE-SU-2026:22636-1 · OSV

Track software like this

Free during beta