REDHAT-BUG-2346421: Buffer Overflow
First published: Tue Feb 18 2025(Updated: )
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to <a href="https://access.redhat.com/security/cve/CVE-2017-9047">CVE-2017-9047</a>.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libxml2-devel | <2.12.10>2.13.0<2.13.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2017-9047
- https://access.redhat.com/errata/RHSA-2025:2482
- https://access.redhat.com/errata/RHSA-2025:2483
- https://access.redhat.com/errata/RHSA-2025:2507
- https://access.redhat.com/errata/RHSA-2025:2513
- https://access.redhat.com/errata/RHSA-2025:2654
- https://access.redhat.com/errata/RHSA-2025:2660
- https://access.redhat.com/errata/RHSA-2025:2673
- https://access.redhat.com/errata/RHSA-2025:2678
- https://access.redhat.com/errata/RHSA-2025:2679
- https://access.redhat.com/errata/RHSA-2025:2686
- https://access.redhat.com/errata/RHSA-2025:3055
- https://access.redhat.com/errata/RHSA-2025:3297
- https://access.redhat.com/errata/RHSA-2025:3453
- https://access.redhat.com/errata/RHSA-2025:3301
- https://bugzilla.redhat.com/show_bug.cgi?id=2346421
Frequently Asked Questions
What is the severity of REDHAT-BUG-2346421?
The severity of REDHAT-BUG-2346421 is critical due to the potential for remote code execution through stack-based buffer overflow.
How do I fix REDHAT-BUG-2346421?
To fix REDHAT-BUG-2346421, update libxml2 to version 2.12.10 or higher, or to version 2.13.6 or higher.
Which versions of libxml2 are affected by REDHAT-BUG-2346421?
Versions of libxml2 before 2.12.10 and versions between 2.13.0 and 2.13.6 are affected by REDHAT-BUG-2346421.
What type of vulnerability is REDHAT-BUG-2346421?
REDHAT-BUG-2346421 is a stack-based buffer overflow vulnerability located in the xmlSnprintfElements function.
What conditions must be met to exploit REDHAT-BUG-2346421?
Exploitation of REDHAT-BUG-2346421 requires DTD validation to occur for an untrusted document or untrusted DTD.
- agent/weakness
- agent/source
- agent/severity
- agent/description
- agent/first-publish-date
- agent/type
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/last-modified-date
- agent/references
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-24928
- vendor/xmlsoft
- canonical/libxml2-devel