Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

libxml2 may let attackers read memory or cause crashes

published 1 year ago
Summary

The libxml2 library and its related CentOS packages (including the Python bindings) have a flaw that can let specially crafted XML data cause the program to read memory it shouldn’t or crash. This could expose sensitive information or disrupt services that rely on XML processing. Apply the latest updates for libxml2, libxml2-devel, libxml2-static, and python3-libxml2 from CentOS as soon as possible.

What to do
  • Update centos libxml2 to version 2.9.7-9.el8_4.2.tuxcare.els10.
  • Update centos libxml2-devel to version 2.9.7-9.el8_4.2.tuxcare.els10.
  • Update centos libxml2-static to version 2.9.7-9.el8_4.2.tuxcare.els10.
  • Update centos python3-libxml2 to version 2.9.7-9.el8_4.2.tuxcare.els10.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:CentOS:8.5 centos libxml2 < 2.9.7-9.el8_4.2.tuxcare.els10
Fix: upgrade to 2.9.7-9.el8_4.2.tuxcare.els10
TuxCare:CentOS:8.5 centos libxml2-devel < 2.9.7-9.el8_4.2.tuxcare.els10
Fix: upgrade to 2.9.7-9.el8_4.2.tuxcare.els10
TuxCare:CentOS:8.5 centos libxml2-static < 2.9.7-9.el8_4.2.tuxcare.els10
Fix: upgrade to 2.9.7-9.el8_4.2.tuxcare.els10
TuxCare:CentOS:8.5 centos python3-libxml2 < 2.9.7-9.el8_4.2.tuxcare.els10
Fix: upgrade to 2.9.7-9.el8_4.2.tuxcare.els10
Original advisory text
libxml2: Fix of 2 CVEs
- CVE-2025-32415: fix heap-based buffer under-read in xmlSchemaIDCFillNodeTables
function
- CVE-2025-32414: fix out-of-bounds memory access in Python API by correcting
return value in xmlPythonFileRead and xmlPythonFileReadRaw.
References
Timeline
Published9 May 2025
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2025-1746792339 · OSV
Track software like this
Free during beta