{
  "threat_severity" : "Moderate",
  "public_date" : "2024-02-04T00:00:00Z",
  "bugzilla" : {
    "description" : "libxml2: use-after-free in XMLReader",
    "id" : "2262726",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2262726"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.", "A use-after-free flaw was found in libxml2. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free." ],
  "statement" : "The severity of this vulnerability is not important but moderate due to the lack of impact to both confidentiality and integrity, but potential impact to availability. The theoretical risk of impact to availability is limited due to the specific requirement that applications must continue to misuse the reader API after it has already reported validation errors instead of handling those errors. The flaw requires that crafted XML documents can be provided by an attacker and the utilization of DTD validation and XInclude expansion using the XMLReader API. Along with those conditions, the application using the XMLReader API must be ignoring errors when expanding invalid XInclude nodes in an maliciously crafted document. These conditions are unlikely to exist in the intended usage of the XMLReader API.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-06-05T00:00:00Z",
    "advisory" : "RHSA-2024:3626",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "libxml2-0:2.9.7-18.el8_10.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-06-05T00:00:00Z",
    "advisory" : "RHSA-2024:3626",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "libxml2-0:2.9.7-18.el8_10.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:3299",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.6",
    "package" : "libxml2-0:2.9.7-13.el8_6.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Extended Update Support",
    "release_date" : "2024-05-23T00:00:00Z",
    "advisory" : "RHSA-2024:3303",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.8",
    "package" : "libxml2-0:2.9.7-16.el8_8.4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-05-02T00:00:00Z",
    "advisory" : "RHSA-2024:2679",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "libxml2-0:2.9.13-6.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-05-02T00:00:00Z",
    "advisory" : "RHSA-2024:2679",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "libxml2-0:2.9.13-6.el9_4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Extended Update Support",
    "release_date" : "2024-06-05T00:00:00Z",
    "advisory" : "RHSA-2024:3625",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.2",
    "package" : "libxml2-0:2.9.13-3.el9_2.3"
  }, {
    "product_name" : "Text-Only JBCS",
    "release_date" : "2024-03-18T00:00:00Z",
    "advisory" : "RHSA-2024:1317",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1",
    "package" : "libxml2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "libxml2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Satellite 6",
    "fix_state" : "Affected",
    "package_name" : "puppet-agent",
    "cpe" : "cpe:/a:redhat:satellite:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-25062\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-25062\nhttps://gitlab.gnome.org/GNOME/libxml2/-/issues/604\nhttps://gitlab.gnome.org/GNOME/libxml2/-/tags" ],
  "name" : "CVE-2024-25062",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}