CVE catalog

CVE-2024-34459

libxml2 vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.80% · Oct 27, 2026

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed
Ubuntulibxml2noble2.9.14+dfsg-1.3~deb12u2fixed
Ubuntulibxml2noble2.9.14+dfsg-1.3ubuntu3.2fixed
Ubuntulibxml2-devnoble2.9.14+dfsg-1.3ubuntu3.2fixed
Ubuntulibxml2-docnoble2.9.14+dfsg-1.3ubuntu3.2fixed
Ubuntulibxml2-utilsnoble2.9.14+dfsg-1.3ubuntu3.2fixed
Ubuntupython3-libxml2noble2.9.14+dfsg-1.3ubuntu3.2fixed
Ubuntulibxml2noble2.9.14+dfsg-1.3ubuntu3.1fixed
Ubuntulibxml2-devnoble2.9.14+dfsg-1.3ubuntu3.1fixed
Ubuntulibxml2-docnoble2.9.14+dfsg-1.3ubuntu3.1fixed
Ubuntulibxml2-utilsnoble2.9.14+dfsg-1.3ubuntu3.1fixed
Ubuntupython3-libxml2noble2.9.14+dfsg-1.3ubuntu3.1fixed
Cpelibxml2Not reported2.12.7fixed
Alpinelibxml23.182.11.8-r0fixed
Alpinelibxml23.192.11.8-r0fixed
Alpinelibxml23.202.12.7-r0fixed
Alpinelibxml23.212.12.7-r0fixed
Alpinelibxml23.222.12.7-r0fixed
Alpinelibxml23.232.12.7-r0fixed
Alpinelibxml23.242.12.7-r0fixed
Ubuntulibxml2pro2.9.4+dfsg1-4ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-5ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-5ubuntu2vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-5.1ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-5.2ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.2vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.3vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.4vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.5vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.6vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.7vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.8vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.9vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.9+esm1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-6.1ubuntu1.9+esm2fixed
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu3vulnerable
Ubuntulibxml220.042.9.4+dfsg1-7ubuntu5vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu1vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu2vulnerable
Ubuntulibxml220.042.9.4+dfsg1-8ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-1ubuntu3vulnerable
Ubuntulibxml220.042.9.10+dfsg-4build1vulnerable
Ubuntulibxml220.042.9.10+dfsg-5vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.1vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.2vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.3vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.4vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.5vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.6vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.7vulnerable
Ubuntulibxml220.042.9.10+dfsg-5ubuntu0.20.04.8fixed
Ubuntulibxml222.042.9.12+dfsg-4vulnerable
Ubuntulibxml222.042.9.12+dfsg-5vulnerable
Ubuntulibxml222.042.9.12+dfsg-6vulnerable
Ubuntulibxml222.042.9.13+dfsg-1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1build1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.2vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.3vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.4vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.5fixed
Ubuntulibxml224.042.9.14+dfsg-1.3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build1vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build2vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu1vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu2vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.1fixed
Suselibxml2linux micro 6.02.11.6-3.1fixed
Suselibxml2linux enterprise micro 5.12.9.7-150000.3.70.1fixed
Suselibxml2linux enterprise micro 5.22.9.7-150000.3.70.1fixed
Susepython-libxml2-pythonlinux enterprise micro 5.22.9.7-150000.3.70.1fixed
Opensusepython-libxml2-pythonleap 15.52.9.7-150000.3.70.1fixed
Opensusepython-libxml2-pythonleap 15.62.9.7-150000.3.70.1fixed
Opensuselibxml2tumbleweed2.12.7-1.1fixed
Suselibxml2linux enterprise micro 5.52.10.3-150500.5.17.1fixed
Suselibxml2-pythonlinux enterprise micro 5.52.10.3-150500.5.17.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp52.10.3-150500.5.17.1fixed
Suselibxml2-pythonlinux enterprise module for basesystem 15 sp52.10.3-150500.5.17.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp62.10.3-150500.5.17.1fixed
Suselibxml2-pythonlinux enterprise module for basesystem 15 sp62.10.3-150500.5.17.1fixed
Suselibxml2-pythonlinux enterprise module for python 3 15 sp52.10.3-150500.5.17.1fixed
Suselibxml2-pythonlinux enterprise module for python 3 15 sp62.10.3-150500.5.17.1fixed
Opensuselibxml2leap 15.52.10.3-150500.5.17.1fixed
Opensuselibxml2-pythonleap 15.52.10.3-150500.5.17.1fixed
Opensuselibxml2leap 15.62.10.3-150500.5.17.1fixed
Opensuselibxml2-pythonleap 15.62.10.3-150500.5.17.1fixed
Suselibxml2linux enterprise micro 5.32.9.14-150400.5.32.1fixed
Suselibxml2-pythonlinux enterprise micro 5.32.9.14-150400.5.32.1fixed
Suselibxml2linux enterprise micro 5.42.9.14-150400.5.32.1fixed
Suselibxml2-pythonlinux enterprise micro 5.42.9.14-150400.5.32.1fixed
Suselibxml2linux enterprise software development kit 12 sp52.9.4-46.75.1fixed
Suselibxml2linux enterprise server 12 sp52.9.4-46.75.1fixed
Susepython-libxml2linux enterprise server 12 sp52.9.4-46.75.1fixed
Suselibxml2linux enterprise server for sap applications 12 sp52.9.4-46.75.1fixed
Susepython-libxml2linux enterprise server for sap applications 12 sp52.9.4-46.75.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.12.7+dfsg+really2.9.14-0.4unimportantNot reported[1071162]
Debianlibxml2sourceforky2.12.7+dfsg+really2.9.14-0.4unimportantNot reported[1071162]
Debianlibxml2sourcetrixie2.12.7+dfsg+really2.9.14-0.4unimportantNot reported[1071162]
Debianlibxml2sourcebookworm2.9.14+dfsg-1.3~deb12u2not yet assignedNot reported[1071162]
Ubuntulibxml2debnoble2.9.14+dfsg-1.3~deb12u2Not reportedNot reportedNot reported
Ubuntulibxml2debnoble2.9.14+dfsg-1.3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibxml2-devdebnoble2.9.14+dfsg-1.3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibxml2-docdebnoble2.9.14+dfsg-1.3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibxml2-utilsdebnoble2.9.14+dfsg-1.3ubuntu3.2Not reportedNot reportedNot reported
Ubuntupython3-libxml2debnoble2.9.14+dfsg-1.3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibxml2debnoble2.9.14+dfsg-1.3ubuntu3.1Not reportedNot reportedNot reported
Ubuntulibxml2-devdebnoble2.9.14+dfsg-1.3ubuntu3.1Not reportedNot reportedNot reported
Ubuntulibxml2-docdebnoble2.9.14+dfsg-1.3ubuntu3.1Not reportedNot reportedNot reported
Ubuntulibxml2-utilsdebnoble2.9.14+dfsg-1.3ubuntu3.1Not reportedNot reportedNot reported
Ubuntupython3-libxml2debnoble2.9.14+dfsg-1.3ubuntu3.1Not reportedNot reportedNot reported
Cpelibxml2cpeNot reported2.12.7Not reportedNVD-CVE-2024-34459Not reported
Alpinelibxml2apk3.182.11.8-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.192.11.8-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.202.12.7-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.212.12.7-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.222.12.7-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.232.12.7-r0Not reportedALPINE-CVE-2024-34459Not reported
Alpinelibxml2apk3.242.12.7-r0Not reportedALPINE-CVE-2024-34459Not reported
Ubuntulibxml2debpro2.9.4+dfsg1-6.1ubuntu1.9+esm2Not reportedUBUNTU-CVE-2024-34459Not reported
Ubuntulibxml2deb20.042.9.10+dfsg-5ubuntu0.20.04.8Not reportedUBUNTU-CVE-2024-34459Not reported
Ubuntulibxml2deb22.042.9.13+dfsg-1ubuntu0.5Not reportedUBUNTU-CVE-2024-34459Not reported
Ubuntulibxml2deb24.042.9.14+dfsg-1.3ubuntu3.1Not reportedUBUNTU-CVE-2024-34459Not reported
Suselibxml2rpmlinux micro 6.02.11.6-3.1Not reportedSUSE-SU-2025:20043-1Not reported
Suselibxml2rpmlinux enterprise micro 5.12.9.7-150000.3.70.1Not reportedSUSE-SU-2024:2267-1Not reported
Suselibxml2rpmlinux enterprise micro 5.22.9.7-150000.3.70.1Not reportedSUSE-SU-2024:2267-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise micro 5.22.9.7-150000.3.70.1Not reportedSUSE-SU-2024:2267-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.52.9.7-150000.3.70.1Not reportedSUSE-SU-2024:2267-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.62.9.7-150000.3.70.1Not reportedSUSE-SU-2024:2267-1Not reported
Opensuselibxml2rpmtumbleweed2.12.7-1.1Not reportedOPENSUSE-SU-2024:13971-1Not reported
Suselibxml2rpmlinux enterprise micro 5.52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for basesystem 15 sp52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp62.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for basesystem 15 sp62.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for python 3 15 sp52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for python 3 15 sp62.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Opensuselibxml2rpmleap 15.52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Opensuselibxml2-pythonrpmleap 15.52.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Opensuselibxml2rpmleap 15.62.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Opensuselibxml2-pythonrpmleap 15.62.10.3-150500.5.17.1Not reportedSUSE-SU-2024:2290-1Not reported
Suselibxml2rpmlinux enterprise micro 5.32.9.14-150400.5.32.1Not reportedSUSE-SU-2024:2279-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.32.9.14-150400.5.32.1Not reportedSUSE-SU-2024:2279-1Not reported
Suselibxml2rpmlinux enterprise micro 5.42.9.14-150400.5.32.1Not reportedSUSE-SU-2024:2279-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.42.9.14-150400.5.32.1Not reportedSUSE-SU-2024:2279-1Not reported
Suselibxml2rpmlinux enterprise software development kit 12 sp52.9.4-46.75.1Not reportedSUSE-SU-2024:2288-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp52.9.4-46.75.1Not reportedSUSE-SU-2024:2288-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp52.9.4-46.75.1Not reportedSUSE-SU-2024:2288-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.75.1Not reportedSUSE-SU-2024:2288-1Not reported
Susepython-libxml2rpmlinux enterprise server for sap applications 12 sp52.9.4-46.75.1Not reportedSUSE-SU-2024:2288-1Not reported

[Debian bug #1071162]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libxml2-16]Unknown

    Source package: [libxml2]

    Details (1)
    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.12.7-1.1

      Version impact unknown

      usn · libxml2 · opensuse · tumbleweed

  • Source package: [libxml2]

    Details (1)
    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.12.7-1.1

      Version impact unknown

      usn · libxml2 · opensuse · tumbleweed

  • [libxml2-devel]Unknown

    Source package: [libxml2]

    Details (1)
    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.12.7-1.1

      Version impact unknown

      usn · libxml2 · opensuse · tumbleweed

  • Source package: [libxml2]

    Details (1)
    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.12.7-1.1

      Version impact unknown

      usn · libxml2 · opensuse · tumbleweed

  • [libxml2-tools]Unknown

    Source package: [libxml2]

    Details (1)
    • 2.15.3-2.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.12.7-1.1

      Version impact unknown

      usn · libxml2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libxml2]Fixed
    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

  • Source package: [libxml2]

    Details (4)
    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.9.14+dfsg-1.3~deb12u2

      usn · libxml2 · debian · bookworm

Observed:

References