SUSE-SU-2024:0613-1: Security update for libxml2
This update for libxml2 fixes the following issues: CVE-2024-25062: Fixed use-after-free in XMLReader (bsc#1219576).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/python311-libxml2to a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-debuginfo-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/python3-libxml2to a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/python3-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-develto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-toolsto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-debugsourceto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-python-debugsourceto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/python311-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-32bit-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-develto a version that resolves this vulnerability.Fixed in 32bit-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-32bit-debuginfo-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-docto a version that resolves this vulnerability.Fixed in 2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-64bit-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2-develto a version that resolves this vulnerability.Fixed in 64bit-2.9.14-150400.5.28.1 - Upgrade
Upgrade
suse/libxml2to a version that resolves this vulnerability.Fixed in 2-64bit-debuginfo-2.9.14-150400.5.28.1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch SUSE-2024-613=1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch SUSE-SLE-Micro-5.3-2024-613=1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch SUSE-SLE-Micro-5.4-2024-613=1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch openSUSE-Leap-Micro-5.3-2024-613=1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch openSUSE-Leap-Micro-5.4-2024-613=1
Event History
Frequently Asked Questions
Which installed packages should be checked when determining exposure?
Check for SUSE libxml2 packages, including libxml2, python3-libxml2, libxml2-tools, libxml2-devel, and the listed debug or debuginfo variants. Systems with an affected libxml2 installation should apply this security update.
What type of flaw does this update address?
The update fixes CVE-2024-25062, a use-after-free vulnerability in XMLReader. The advisory rates the update as medium severity with a severity value of 4.