CVE catalog

CVE-2025-7425

libxml2 vulnerability

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxsltsid1.1.45-0.1vulnerable
Debianlibxsltforky1.1.45-0.1vulnerable
Debianlibxslttrixie1.1.35-1.2+deb13u3not affected
Debianlibxslttrixie-security1.1.35-1.2+deb13u2not affected
Debianlibxsltbookworm1.1.35-1+deb12u4not affected
Debianlibxsltbookworm-security1.1.35-1+deb12u3not affected
UbuntulibxsltnobleNot reportednot affected
Ubuntulibxml2noble2.9.14+dfsg-1.3ubuntu3.6fixed
Ubuntulibxml2-devnoble2.9.14+dfsg-1.3ubuntu3.6fixed
Ubuntulibxml2-docnoble2.9.14+dfsg-1.3ubuntu3.6fixed
Ubuntulibxml2-utilsnoble2.9.14+dfsg-1.3ubuntu3.6fixed
Ubuntupython3-libxml2noble2.9.14+dfsg-1.3ubuntu3.6fixed
BitnamijavaNot reported1.8.0fixed
BitnamijavaNot reported8.0.481fixed
BitnamijreNot reported1.8.0fixed
BitnamijreNot reported8.0.481fixed
Bitnamijava-minNot reported1.8.0fixed
Bitnamijava-minNot reported8.0.481fixed
Ubuntulibxml2pro2.9.4+dfsg1-7ubuntu3vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-7ubuntu5vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-8ubuntu1vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-8ubuntu2vulnerable
Ubuntulibxml2pro2.9.4+dfsg1-8ubuntu3vulnerable
Ubuntulibxml2pro2.9.10+dfsg-1ubuntu3vulnerable
Ubuntulibxml2pro2.9.10+dfsg-4build1vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.1vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.2vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.3vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.4vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.5vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.6vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.7vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.8vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.9vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.10vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.10+esm1vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.10+esm2vulnerable
Ubuntulibxml2pro2.9.10+dfsg-5ubuntu0.20.04.10+esm3fixed
Ubuntulibxml222.042.9.12+dfsg-4vulnerable
Ubuntulibxml222.042.9.12+dfsg-5vulnerable
Ubuntulibxml222.042.9.12+dfsg-6vulnerable
Ubuntulibxml222.042.9.13+dfsg-1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1build1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.1vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.2vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.3vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.4vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.5vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.6vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.7vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.8vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.9vulnerable
Ubuntulibxml222.042.9.13+dfsg-1ubuntu0.10fixed
Ubuntulibxml224.042.9.14+dfsg-1.3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build1vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build2vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3build3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu1vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu2vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.1vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.2vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.3vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.4vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.5vulnerable
Ubuntulibxml224.042.9.14+dfsg-1.3ubuntu3.6fixed
Opensuselibxml2tumbleweed2.13.8-3.1fixed
Suselibxml2linux enterprise server 12 sp5-ltss2.9.4-46.90.1fixed
Susepython-libxml2linux enterprise server 12 sp5-ltss2.9.4-46.90.1fixed
Suselibxml2linux enterprise server ltss extended security 12 sp52.9.4-46.90.1fixed
Susepython-libxml2linux enterprise server ltss extended security 12 sp52.9.4-46.90.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp72.12.10-150700.4.6.1fixed
Suselibxml2-pythonlinux enterprise module for basesystem 15 sp72.12.10-150700.4.6.1fixed
Suselibxml2-pythonlinux enterprise module for python 3 15 sp72.12.10-150700.4.6.1fixed
Suselibxml2linux enterprise micro 5.52.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise micro 5.52.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise module for basesystem 15 sp62.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise module for basesystem 15 sp62.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise module for python 3 15 sp62.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise high performance computing 15 sp5-espos2.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise high performance computing 15 sp5-espos2.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise high performance computing 15 sp5-ltss2.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise high performance computing 15 sp5-ltss2.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise server 15 sp5-ltss2.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise server 15 sp5-ltss2.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp52.10.3-150500.5.32.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 15 sp52.10.3-150500.5.32.1fixed
Opensuselibxml2leap 15.62.10.3-150500.5.32.1fixed
Opensuselibxml2-pythonleap 15.62.10.3-150500.5.32.1fixed
Suselibxml2linux enterprise micro 5.32.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise micro 5.32.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise micro 5.42.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise micro 5.42.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise high performance computing 15 sp4-espos2.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise high performance computing 15 sp4-espos2.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise high performance computing 15 sp4-ltss2.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise high performance computing 15 sp4-ltss2.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise server 15 sp4-ltss2.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise server 15 sp4-ltss2.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp42.9.14-150400.5.47.1fixed
Suselibxml2-pythonlinux enterprise server for sap applications 15 sp42.9.14-150400.5.47.1fixed
Suselibxml2manager proxy lts 4.32.9.14-150400.5.47.1fixed
Suselibxml2-pythonmanager proxy lts 4.32.9.14-150400.5.47.1fixed
Suselibxml2manager server lts 4.32.9.14-150400.5.47.1fixed
Suselibxml2-pythonmanager server lts 4.32.9.14-150400.5.47.1fixed
Suselibxml2linux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.85.1fixed
Susepython-libxml2-pythonlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.85.1fixed
Suselibxml2linux enterprise server 15 sp3-ltss2.9.7-150000.3.85.1fixed
Susepython-libxml2-pythonlinux enterprise server 15 sp3-ltss2.9.7-150000.3.85.1fixed
Suselibxml2linux enterprise server for sap applications 15 sp32.9.7-150000.3.85.1fixed
Susepython-libxml2-pythonlinux enterprise server for sap applications 15 sp32.9.7-150000.3.85.1fixed
Suselibxml2linux enterprise micro 5.12.9.7-150000.3.85.1fixed
Suselibxml2linux enterprise micro 5.22.9.7-150000.3.85.1fixed
Susepython-libxml2-pythonlinux enterprise micro 5.22.9.7-150000.3.85.1fixed
Suselibxml2enterprise storage 7.12.9.7-150000.3.85.1fixed
Susepython-libxml2-pythonenterprise storage 7.12.9.7-150000.3.85.1fixed
Opensusepython-libxml2-pythonleap 15.62.9.7-150000.3.85.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxsltsourcesid(unfixed)not yet assignedNot reported[1109122]
Debianlibxsltsourceforky(unfixed)not yet assignedNot reported[1109122]
DebianlibxsltsourcetrixieNot affectedunimportantNot reported[1109122]
DebianlibxsltsourcebookwormNot affectedunimportantNot reported[1109122]
Ubuntulibxml2debnoble2.9.14+dfsg-1.3ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibxml2-devdebnoble2.9.14+dfsg-1.3ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibxml2-docdebnoble2.9.14+dfsg-1.3ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibxml2-utilsdebnoble2.9.14+dfsg-1.3ubuntu3.6Not reportedNot reportedNot reported
Ubuntupython3-libxml2debnoble2.9.14+dfsg-1.3ubuntu3.6Not reportedNot reportedNot reported
BitnamijavaBitnamiNot reported1.8.0Not reportedBIT-JAVA-2025-7425Not reported
BitnamijavaBitnamiNot reported8.0.481Not reportedBIT-JAVA-2025-7425Not reported
BitnamijreBitnamiNot reported1.8.0Not reportedBIT-JRE-2025-7425Not reported
BitnamijreBitnamiNot reported8.0.481Not reportedBIT-JRE-2025-7425Not reported
Bitnamijava-minBitnamiNot reported1.8.0Not reportedBIT-JAVA-MIN-2025-7425Not reported
Bitnamijava-minBitnamiNot reported8.0.481Not reportedBIT-JAVA-MIN-2025-7425Not reported
Ubuntulibxml2debpro2.9.10+dfsg-5ubuntu0.20.04.10+esm3Not reportedUSN-7852-2Not reported
Ubuntulibxml2deb22.042.9.13+dfsg-1ubuntu0.10Not reportedUSN-7852-1Not reported
Ubuntulibxml2deb24.042.9.14+dfsg-1.3ubuntu3.6Not reportedUSN-7852-1Not reported
Opensuselibxml2rpmtumbleweed2.13.8-3.1Not reportedOPENSUSE-SU-2025:15363-1Not reported
Suselibxml2rpmlinux enterprise server 12 sp5-ltss2.9.4-46.90.1Not reportedSUSE-SU-2025:02547-1Not reported
Susepython-libxml2rpmlinux enterprise server 12 sp5-ltss2.9.4-46.90.1Not reportedSUSE-SU-2025:02547-1Not reported
Suselibxml2rpmlinux enterprise server ltss extended security 12 sp52.9.4-46.90.1Not reportedSUSE-SU-2025:02547-1Not reported
Susepython-libxml2rpmlinux enterprise server ltss extended security 12 sp52.9.4-46.90.1Not reportedSUSE-SU-2025:02547-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp72.12.10-150700.4.6.1Not reportedSUSE-SU-2025:02617-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for basesystem 15 sp72.12.10-150700.4.6.1Not reportedSUSE-SU-2025:02617-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for python 3 15 sp72.12.10-150700.4.6.1Not reportedSUSE-SU-2025:02617-1Not reported
Suselibxml2rpmlinux enterprise micro 5.52.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.52.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise module for basesystem 15 sp62.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for basesystem 15 sp62.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise module for python 3 15 sp62.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp5-espos2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise high performance computing 15 sp5-espos2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp5-ltss2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise high performance computing 15 sp5-ltss2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp5-ltss2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 15 sp5-ltss2.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp52.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 15 sp52.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Opensuselibxml2rpmleap 15.62.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Opensuselibxml2-pythonrpmleap 15.62.10.3-150500.5.32.1Not reportedSUSE-SU-2025:02758-1Not reported
Suselibxml2rpmlinux enterprise micro 5.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise micro 5.42.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise micro 5.42.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp4-espos2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise high performance computing 15 sp4-espos2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp4-ltss2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise high performance computing 15 sp4-ltss2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp4-ltss2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise server 15 sp4-ltss2.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp42.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmlinux enterprise server for sap applications 15 sp42.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmmanager proxy lts 4.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmmanager proxy lts 4.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmmanager server lts 4.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2-pythonrpmmanager server lts 4.32.9.14-150400.5.47.1Not reportedSUSE-SU-2025:02620-1Not reported
Suselibxml2rpmlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise high performance computing 15 sp3-ltss2.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Suselibxml2rpmlinux enterprise server 15 sp3-ltss2.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server 15 sp3-ltss2.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Suselibxml2rpmlinux enterprise server for sap applications 15 sp32.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise server for sap applications 15 sp32.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Suselibxml2rpmlinux enterprise micro 5.12.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Suselibxml2rpmlinux enterprise micro 5.22.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Susepython-libxml2-pythonrpmlinux enterprise micro 5.22.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Suselibxml2rpmenterprise storage 7.12.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Susepython-libxml2-pythonrpmenterprise storage 7.12.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported
Opensusepython-libxml2-pythonrpmleap 15.62.9.7-150000.3.85.1Not reportedSUSE-SU-2025:02621-1Not reported

[Debian bug #1109122]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References