Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-10911 (GCVE-0-2025-10911)
Vulnerability from cvelistv5 – Published: 2025-09-25 15:13 – Updated: 2026-06-29 23:28
VLAI
EPSS
Title
Libxslt: use-after-free with key data stored cross-rvt
Summary
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-825 - Expired Pointer Dereference
Assigner
References
16 references
Impacted products
19 products
| Vendor | Product | Version | |
|---|---|---|---|
|
Affected:
0 , ≤ 1.1.43
(semver)
|
|||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.1.39-8.el10_2.1 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:1.1.39-8.el10_0.1 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:1.1.32-6.4.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support |
Unaffected:
0:1.1.32-8.el8_4.1 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On |
Unaffected:
0:1.1.32-8.el8_4.1 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support |
Unaffected:
0:1.1.32-8.el8_6.1 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On |
Unaffected:
0:1.1.32-8.el8_6.1 , < *
(rpm)
cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service |
Unaffected:
0:1.1.32-8.el8_8.1 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions |
Unaffected:
0:1.1.32-8.el8_8.1 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.1.34-14.el9_8.1 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:1.1.34-12.el9_2 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions |
Unaffected:
0:1.1.34-15.el9_4 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.4::appstream |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:1.1.34-13.el9_6.2 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6::appstream |
|
| Red Hat | Red Hat Discovery 2 |
Unaffected:
1782756541 , < *
(rpm)
cpe:/a:redhat:discovery:2::el9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.1.45-0.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
Date Public
2025-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-29T15:48:55.245495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T15:49:06.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gitlab.gnome.org/GNOME/libxslt",
"defaultStatus": "unaffected",
"packageName": "libxslt",
"versions": [
{
"lessThanOrEqual": "1.1.43",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.39-8.el10_2.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.39-8.el10_0.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-6.4.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-6.4.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_4.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_4.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_6.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_6.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream",
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream",
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.32-8.el8_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.34-14.el9_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.34-12.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.34-15.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.34-13.el9_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-ui-rhel9",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782756541",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libxslt-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.1.45-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "libxslt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"datePublic": "2025-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T23:28:23.018Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:11015",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11015"
},
{
"name": "RHSA-2026:26355",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26355"
},
{
"name": "RHSA-2026:28243",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28243"
},
{
"name": "RHSA-2026:28584",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28584"
},
{
"name": "RHSA-2026:29807",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29807"
},
{
"name": "RHSA-2026:29809",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29809"
},
{
"name": "RHSA-2026:29811",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29811"
},
{
"name": "RHSA-2026:29814",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29814"
},
{
"name": "RHSA-2026:29975",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29975"
},
{
"name": "RHSA-2026:29976",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29976"
},
{
"name": "RHSA-2026:30847",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30847"
},
{
"name": "RHSA-2026:33313",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"name": "RHBZ#2397838",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-24T12:46:50.095Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2025-08-04T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libxslt: use-after-free with key data stored cross-rvt",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-825: Expired Pointer Dereference"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2025-10911",
"datePublished": "2025-09-25T15:13:14.210Z",
"dateReserved": "2025-09-24T12:45:24.913Z",
"dateUpdated": "2026-06-29T23:28:23.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-10911",
"date": "2026-06-29",
"epss": "0.00161",
"percentile": "0.05689"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-10911\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2025-09-25T16:15:31.337\",\"lastModified\":\"2026-06-30T00:16:50.993\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://gitlab.gnome.org/GNOME/libxslt\",\"packageName\":\"libxslt\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"1.1.43\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:1.1.39-8.el10_2.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:1.1.39-8.el10_0.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\",\"cpe:/o:redhat:enterprise_linux:8::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-6.4.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\",\"cpe:/o:redhat:enterprise_linux:8::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-6.4.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\",\"cpe:/o:redhat:rhel_aus:8.4::baseos\",\"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_4.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.4::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\",\"cpe:/o:redhat:rhel_aus:8.4::baseos\",\"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_4.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\",\"cpe:/o:redhat:rhel_aus:8.6::baseos\",\"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_6.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_aus:8.6::appstream\",\"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\",\"cpe:/o:redhat:rhel_aus:8.6::baseos\",\"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_6.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\",\"cpe:/o:redhat:rhel_e4s:8.8::baseos\",\"cpe:/o:redhat:rhel_tus:8.8::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:8.8::appstream\",\"cpe:/a:redhat:rhel_tus:8.8::appstream\",\"cpe:/o:redhat:rhel_e4s:8.8::baseos\",\"cpe:/o:redhat:rhel_tus:8.8::baseos\"],\"versions\":[{\"version\":\"0:1.1.32-8.el8_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\"],\"versions\":[{\"version\":\"0:1.1.34-14.el9_8.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"],\"versions\":[{\"version\":\"0:1.1.34-12.el9_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"],\"versions\":[{\"version\":\"0:1.1.34-15.el9_4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6::appstream\"],\"versions\":[{\"version\":\"0:1.1.34-13.el9_6.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1782756541\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"libxslt-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.1.45-0.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libxslt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-29T15:48:55.245495Z\",\"id\":\"CVE-2025-10911\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-825\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11015\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26355\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28243\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28584\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29807\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29809\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29811\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29814\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29975\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29976\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30847\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33313\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-10911\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2397838\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.gnome.org/GNOME/libxslt/-/issues/144\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77\",\"source\":\"secalert@redhat.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-10911\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-29T15:48:55.245495Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-29T15:49:00.370Z\"}}], \"cna\": {\"title\": \"Libxslt: use-after-free with key data stored cross-rvt\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.1.43\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://gitlab.gnome.org/GNOME/libxslt\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.39-8.el10_2.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.39-8.el10_0.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/o:redhat:enterprise_linux:8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-6.4.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/o:redhat:enterprise_linux:8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-6.4.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\", \"cpe:/o:redhat:rhel_aus:8.4::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_4.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.4::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream\", \"cpe:/o:redhat:rhel_aus:8.4::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_4.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\", \"cpe:/o:redhat:rhel_aus:8.6::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_aus:8.6::appstream\", \"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream\", \"cpe:/o:redhat:rhel_aus:8.6::baseos\", \"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_6.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\", \"cpe:/o:redhat:rhel_e4s:8.8::baseos\", \"cpe:/o:redhat:rhel_tus:8.8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Telecommunications Update Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:8.8::appstream\", \"cpe:/a:redhat:rhel_tus:8.8::appstream\", \"cpe:/o:redhat:rhel_e4s:8.8::baseos\", \"cpe:/o:redhat:rhel_tus:8.8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.32-8.el8_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.34-14.el9_8.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.34-12.el9_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.4::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.34-15.el9_4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.34-13.el9_6.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782756541\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.1.45-0.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libxslt-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"libxslt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"rhcos\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-09-24T12:46:50.095Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2025-08-04T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2025-08-04T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:11015\", \"name\": \"RHSA-2026:11015\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26355\", \"name\": \"RHSA-2026:26355\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28243\", \"name\": \"RHSA-2026:28243\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28584\", \"name\": \"RHSA-2026:28584\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29807\", \"name\": \"RHSA-2026:29807\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29809\", \"name\": \"RHSA-2026:29809\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29811\", \"name\": \"RHSA-2026:29811\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29814\", \"name\": \"RHSA-2026:29814\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29975\", \"name\": \"RHSA-2026:29975\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29976\", \"name\": \"RHSA-2026:29976\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30847\", \"name\": \"RHSA-2026:30847\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33313\", \"name\": \"RHSA-2026:33313\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2025-10911\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2397838\", \"name\": \"RHBZ#2397838\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://gitlab.gnome.org/GNOME/libxslt/-/issues/144\"}, {\"url\": \"https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-825\", \"description\": \"Expired Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-06-29T23:28:23.018Z\"}, \"x_redhatCweChain\": \"CWE-825: Expired Pointer Dereference\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-10911\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T23:28:23.018Z\", \"dateReserved\": \"2025-09-24T12:45:24.913Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2025-09-25T15:13:14.210Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:30847
Vulnerability from csaf_redhat - Published: 2026-06-29 02:21 - Updated: 2026-06-30 03:05Summary
Red Hat Security Advisory: libxslt security update
Severity
Moderate
Notes
Topic: An update for libxslt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism.
Security Fix(es):
* libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
5.5 (Medium)
Affected products
Fixed
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
10 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for libxslt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. \n\nSecurity Fix(es):\n\n* libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:30847",
"url": "https://access.redhat.com/errata/RHSA-2026:30847"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2397838",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30847.json"
}
],
"title": "Red Hat Security Advisory: libxslt security update",
"tracking": {
"current_release_date": "2026-06-30T03:05:44+00:00",
"generator": {
"date": "2026-06-30T03:05:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:30847",
"initial_release_date": "2026-06-29T02:21:46+00:00",
"revision_history": [
{
"date": "2026-06-29T02:21:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-29T02:21:46+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T03:05:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_aus:8.6::baseos"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"product": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"product_id": "libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-devel@1.1.32-8.el8_6.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"product": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"product_id": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.32-8.el8_6.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"product": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"product_id": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.32-8.el8_6.1?arch=i686"
}
}
},
{
"category": "product_version",
"name": "libxslt-0:1.1.32-8.el8_6.1.i686",
"product": {
"name": "libxslt-0:1.1.32-8.el8_6.1.i686",
"product_id": "libxslt-0:1.1.32-8.el8_6.1.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt@1.1.32-8.el8_6.1?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"product": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"product_id": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-devel@1.1.32-8.el8_6.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"product": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"product_id": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.32-8.el8_6.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"product": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"product_id": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.32-8.el8_6.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libxslt-0:1.1.32-8.el8_6.1.x86_64",
"product": {
"name": "libxslt-0:1.1.32-8.el8_6.1.x86_64",
"product_id": "libxslt-0:1.1.32-8.el8_6.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt@1.1.32-8.el8_6.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-0:1.1.32-8.el8_6.1.src",
"product": {
"name": "libxslt-0:1.1.32-8.el8_6.1.src",
"product_id": "libxslt-0:1.1.32-8.el8_6.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxslt@1.1.32-8.el8_6.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.src"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.src",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.src"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.src",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)",
"product_id": "BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
},
"product_reference": "libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"relates_to_product_reference": "BaseOS-8.6.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2025-09-24T12:46:50.095000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397838"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: use-after-free with key data stored cross-RVT",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "RHBZ#2397838",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
}
],
"release_date": "2025-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T02:21:46+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30847"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.AUS:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:libxslt-devel-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.AUS:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.AUS:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.src",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debuginfo-0:1.1.32-8.el8_6.1.x86_64",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.i686",
"BaseOS-8.6.0.Z.EUS.EXTENSION:libxslt-debugsource-0:1.1.32-8.el8_6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: use-after-free with key data stored cross-RVT"
}
]
}
RHSA-2026:33313
Vulnerability from csaf_redhat - Published: 2026-06-29 22:05 - Updated: 2026-06-30 04:20Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Severity
Important
Notes
Topic: A Subscription Management tool for finding and reporting Red Hat product usage
Details: Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.
5.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
4.4 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
5.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Threats
Impact
Moderate
A flaw was found in libtasn1. A remote attacker could exploit a stack-based buffer overflow vulnerability in the `asn1_expend_octet_string` function. This occurs due to a failure in validating the size of input data. Successful exploitation can lead to a Denial of Service (DoS) condition, making the affected system or application unavailable.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in image-size. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted JXL, HEIF, or JP2 image files that contain zero-sized boxes. The `findBox` function, responsible for image validation, enters an infinite loop when processing these malicious files, leading to an application hang. This can disrupt the availability of services relying on the image-size component.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.
8.0 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.
7.6 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.
7.3 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 | — |
Vendor Fix
fix
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 | — | ||
| Unresolved product id: Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 | — |
Threats
Impact
Important
References
95 references
Acknowledgments
Mohamed Maatallah
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,\nidentifies, and reports environment data, or facts, such as the number of physical and virtual\nsystems on a network, their operating systems, and relevant configuration data stored within\nthem. Discovery also identifies and reports more detailed facts for some versions of key\nRed Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:33313",
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-34459",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-10911",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13151",
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-5278",
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-71319",
"url": "https://access.redhat.com/security/cve/CVE-2025-71319"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33416",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33636",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41411",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
"url": "https://access.redhat.com/security/cve/CVE-2026-8643"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9256",
"url": "https://access.redhat.com/security/cve/CVE-2026-9256"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33313.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2026-06-30T04:20:19+00:00",
"generator": {
"date": "2026-06-30T04:20:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.0"
}
},
"id": "RHSA-2026:33313",
"initial_release_date": "2026-06-29T22:05:31+00:00",
"revision_history": [
{
"date": "2026-06-29T22:05:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-29T22:05:34+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-30T04:20:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 2",
"product": {
"name": "Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3A7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1782763840"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3Ae9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1782756541"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3A6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1782763840"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1782756541"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"relates_to_product_reference": "Red Hat Discovery 2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64 as a component of Red Hat Discovery 2",
"product_id": "Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64",
"relates_to_product_reference": "Red Hat Discovery 2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-34459",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2024-05-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2280532"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects the xmllint program when the `--htmlout\u0027 command line option is used. Additionally, an application is not vulnerable if it does not use or expose the xmllint program.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "RHBZ#2280532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34459",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
}
],
"release_date": "2024-05-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Do not process untrusted files with the xmllint program.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c"
},
{
"acknowledgments": [
{
"names": [
"Mohamed Maatallah"
]
}
],
"cve": "CVE-2025-5278",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-05-27T13:50:20.148000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2368764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GNU Coreutils. The sort utility\u0027s begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this issue is considered Moderate rather than Critical because successful exploitation requires the use of the traditional key specification syntax with an exceptionally large character position value, which is uncommon in typical usage. Although the vulnerability can lead to a heap buffer overflow resulting in a read one byte before the allocated buffer, it does not enable code execution, privilege escalation, or direct compromise of data confidentiality or integrity. The impact is therefore primarily limited to potential service disruption due to application crashes.\n\nFurthermore, default RHEL configurations such as SELinux enforcement, ASLR, and memory protections reduce the likelihood of exploitation and limit the scope of any resulting impact. These safeguards, along with typical system usage patterns that do not commonly invoke the vulnerable code path, restrict exploitability in default and hardened environments. Consequently, the vulnerability\u2019s overall security impact is mitigated compared to flaws that allow immediate code execution or broader compromise across system components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"category": "external",
"summary": "RHBZ#2368764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-5278",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5278"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633",
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633"
},
{
"category": "external",
"summary": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507",
"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507"
}
],
"release_date": "2025-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification"
},
{
"cve": "CVE-2025-10911",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2025-09-24T12:46:50.095000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397838"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: use-after-free with key data stored cross-RVT",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "RHBZ#2397838",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
}
],
"release_date": "2025-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: use-after-free with key data stored cross-RVT"
},
{
"cve": "CVE-2025-13151",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-01-07T22:01:02.206250+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427698"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtasn1. A remote attacker could exploit a stack-based buffer overflow vulnerability in the `asn1_expend_octet_string` function. This occurs due to a failure in validating the size of input data. Successful exploitation can lead to a Denial of Service (DoS) condition, making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat products. A stack-based buffer overflow in the `libtasn1` library, specifically within the `asn1_expend_octet_string` function, can be triggered by failing to validate input data size. This could allow a remote, unauthenticated attacker to cause a denial of service in applications utilizing `libtasn1`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"category": "external",
"summary": "RHBZ#2427698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13151",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1",
"url": "https://gitlab.com/gnutls/libtasn1"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121",
"url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121"
}
],
"release_date": "2026-01-07T21:14:05.223000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string"
},
{
"cve": "CVE-2025-71319",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-06-09T21:01:11.339286+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487296"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in image-size. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted JXL, HEIF, or JP2 image files that contain zero-sized boxes. The `findBox` function, responsible for image validation, enters an infinite loop when processing these malicious files, leading to an application hang. This can disrupt the availability of services relying on the image-size component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `image-size` component, which can be triggered remotely by processing specially crafted JXL, HEIF, or JP2 image files containing zero-sized boxes. This flaw can lead to an application hang due to an infinite loop in the `findBox` function, impacting the availability of services that rely on this image processing library within Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-71319"
},
{
"category": "external",
"summary": "RHBZ#2487296",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487296"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-71319",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71319"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-71319",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71319"
},
{
"category": "external",
"summary": "https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7",
"url": "https://github.com/image-size/image-size/security/advisories/GHSA-m5qc-5hw7-8vg7"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-findbox-function",
"url": "https://www.vulncheck.com/advisories/image-size-denial-of-service-via-infinite-loop-in-findbox-function"
}
],
"release_date": "2026-06-09T19:57:16.125000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "image-size: image-size: Denial of Service due to infinite loop when processing specially crafted images."
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-8643",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-04-22T23:09:35+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in pip\u0027s wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user\u0027s permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8643"
},
{
"category": "external",
"summary": "RHBZ#2460927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8643",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8643"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
},
{
"category": "external",
"summary": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb",
"url": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb"
}
],
"release_date": "2026-05-27T17:03:36.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite"
},
{
"cve": "CVE-2026-9256",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-05-22T15:00:55.131994+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480746"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: ngx_http_rewrite_module: code execution and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this vulnerability, a rewrite directive must be configured with a regex pattern that uses distinct, overlapping PCRE captures and a replacement string referencing multiple such captures, limiting its exposure as this is not the default configuration. This issue allows an attacker to potentially execute arbitrary code or cause a denial of service by forcing the worker process to restart.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9256"
},
{
"category": "external",
"summary": "RHBZ#2480746",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480746"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9256"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000161377",
"url": "https://my.f5.com/manage/s/article/K000161377"
}
],
"release_date": "2026-05-22T14:11:41.877000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions.\n\nFor example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2:\n\n~~~\nrewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1\u0026tab=$2 last;\n~~~\n\nTo mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section:\n\n~~~\nrewrite ^/users/(?\u003cuser_id\u003e[0-9]+)/profile/(?\u003csection\u003e.*)$ /profile.php?id=$user_id\u0026tab=$section last;\n~~~",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: ngx_http_rewrite_module: code execution and denial of service"
},
{
"cve": "CVE-2026-31790",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-03-25T02:59:10.179000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451094"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "RHBZ#2451094",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260407.txt",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
},
{
"cve": "CVE-2026-33416",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-03-26T18:01:55.592413+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can still be referenced, leading to a use-after-free condition. An attacker could potentially exploit this to achieve arbitrary code execution or cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"category": "external",
"summary": "RHBZ#2451805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33416"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb",
"url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667",
"url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25",
"url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1",
"url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/pull/824",
"url": "https://github.com/pnggroup/libpng/pull/824"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j"
}
],
"release_date": "2026-03-26T16:48:54.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "To reduce exposure, avoid processing untrusted PNG image files with applications that utilize libpng. Restricting the source of PNG images to trusted origins can limit the attack surface.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability"
},
{
"cve": "CVE-2026-33636",
"cwe": {
"id": "CWE-124",
"name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
},
"discovery_date": "2026-03-26T18:02:51.339603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451819"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng. A remote attacker could exploit an out-of-bounds read and write vulnerability in the ARM/AArch64 Neon-optimized palette expansion path. This occurs when processing a final partial chunk of 8-bit paletted rows without verifying sufficient input pixels, leading to dereferencing pointers before the start of the row buffer and writing expanded pixel data to underflowed positions. This flaw can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"category": "external",
"summary": "RHBZ#2451819",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451819"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869",
"url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3",
"url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2"
}
],
"release_date": "2026-03-26T16:51:58.289000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion"
},
{
"cve": "CVE-2026-41411",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-24T18:01:49.275019+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461614"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "RHBZ#2461614",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb",
"url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0357",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0357"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8",
"url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"
}
],
"release_date": "2026-04-24T16:51:39.657000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"category": "workaround",
"details": "Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"known_not_affected": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-29T22:05:31+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer\nRPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:6c26d60b5d8eb5a823be4d6e83f2ebb32f5d15216338b85eb4b08aca4dc9316d_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-server-rhel9@sha256:7f4f6ce62705fe518e3513957b4205f106992cd42d1b07975d11aff2dc6ced66_amd64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:3152cbb7f8ab85315ebb95b9f5cd5793c40859ee4487587f16a525ac5d408a44_arm64",
"Red Hat Discovery 2:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:e9614239f2c391d00779cf6c7b998400de90bafbda14aa034e09020723c25a70_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
}
]
}
SUSE-SU-2025:03491-1
Vulnerability from csaf_suse - Published: 2025-10-08 07:37 - Updated: 2025-10-08 07:37Summary
Security update for libxslt
Severity
Moderate
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
- CVE-2025-10911: fixed use-after-free with key data stored cross-RVT (bsc#1250553)
Patchnames: SUSE-2025-3491,SUSE-SUSE-MicroOS-5.1-2025-3491,SUSE-SUSE-MicroOS-5.2-2025-3491,openSUSE-SLE-15.6-2025-3491
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\n - CVE-2025-10911: fixed use-after-free with key data stored cross-RVT (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-3491,SUSE-SUSE-MicroOS-5.1-2025-3491,SUSE-SUSE-MicroOS-5.2-2025-3491,openSUSE-SLE-15.6-2025-3491",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03491-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:03491-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503491-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:03491-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2025-October/042030.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-10-08T07:37:40Z",
"generator": {
"date": "2025-10-08T07:37:40Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:03491-1",
"initial_release_date": "2025-10-08T07:37:40Z",
"revision_history": [
{
"date": "2025-10-08T07:37:40Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.20.1.aarch64",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.20.1.aarch64",
"product_id": "libxslt-devel-1.1.32-150000.3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.20.1.aarch64",
"product": {
"name": "libxslt-python-1.1.32-150000.3.20.1.aarch64",
"product_id": "libxslt-python-1.1.32-150000.3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.20.1.aarch64",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.20.1.aarch64",
"product_id": "libxslt-tools-1.1.32-150000.3.20.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.20.1.aarch64",
"product": {
"name": "libxslt1-1.1.32-150000.3.20.1.aarch64",
"product_id": "libxslt1-1.1.32-150000.3.20.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-64bit-1.1.32-150000.3.20.1.aarch64_ilp32",
"product": {
"name": "libxslt-devel-64bit-1.1.32-150000.3.20.1.aarch64_ilp32",
"product_id": "libxslt-devel-64bit-1.1.32-150000.3.20.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libxslt1-64bit-1.1.32-150000.3.20.1.aarch64_ilp32",
"product": {
"name": "libxslt1-64bit-1.1.32-150000.3.20.1.aarch64_ilp32",
"product_id": "libxslt1-64bit-1.1.32-150000.3.20.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.20.1.i586",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.20.1.i586",
"product_id": "libxslt-devel-1.1.32-150000.3.20.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.20.1.i586",
"product": {
"name": "libxslt-python-1.1.32-150000.3.20.1.i586",
"product_id": "libxslt-python-1.1.32-150000.3.20.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.20.1.i586",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.20.1.i586",
"product_id": "libxslt-tools-1.1.32-150000.3.20.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.20.1.i586",
"product": {
"name": "libxslt1-1.1.32-150000.3.20.1.i586",
"product_id": "libxslt1-1.1.32-150000.3.20.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.20.1.ppc64le",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.20.1.ppc64le",
"product_id": "libxslt-devel-1.1.32-150000.3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"product": {
"name": "libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"product_id": "libxslt-python-1.1.32-150000.3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.20.1.ppc64le",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.20.1.ppc64le",
"product_id": "libxslt-tools-1.1.32-150000.3.20.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.20.1.ppc64le",
"product": {
"name": "libxslt1-1.1.32-150000.3.20.1.ppc64le",
"product_id": "libxslt1-1.1.32-150000.3.20.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.20.1.s390x",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.20.1.s390x",
"product_id": "libxslt-devel-1.1.32-150000.3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.20.1.s390x",
"product": {
"name": "libxslt-python-1.1.32-150000.3.20.1.s390x",
"product_id": "libxslt-python-1.1.32-150000.3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.20.1.s390x",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.20.1.s390x",
"product_id": "libxslt-tools-1.1.32-150000.3.20.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.20.1.s390x",
"product": {
"name": "libxslt1-1.1.32-150000.3.20.1.s390x",
"product_id": "libxslt1-1.1.32-150000.3.20.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt-devel-1.1.32-150000.3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-devel-32bit-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt-devel-32bit-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt-devel-32bit-1.1.32-150000.3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt-python-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt-python-1.1.32-150000.3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt-tools-1.1.32-150000.3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt1-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt1-1.1.32-150000.3.20.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-32bit-1.1.32-150000.3.20.1.x86_64",
"product": {
"name": "libxslt1-32bit-1.1.32-150000.3.20.1.x86_64",
"product_id": "libxslt1-32bit-1.1.32-150000.3.20.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.1",
"product": {
"name": "SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.aarch64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.aarch64"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.s390x as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.s390x"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.x86_64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.x86_64"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.aarch64"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.s390x"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.20.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.x86_64"
},
"product_reference": "libxslt1-1.1.32-150000.3.20.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.20.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.aarch64"
},
"product_reference": "libxslt-python-1.1.32-150000.3.20.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.20.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.ppc64le"
},
"product_reference": "libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.20.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.s390x"
},
"product_reference": "libxslt-python-1.1.32-150000.3.20.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.20.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.x86_64"
},
"product_reference": "libxslt-python-1.1.32-150000.3.20.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.20.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.20.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.20.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-08T07:37:40Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
}
]
}
SUSE-SU-2025:03595-1
Vulnerability from csaf_suse - Published: 2025-10-14 21:07 - Updated: 2025-10-14 21:07Summary
Security update for libxslt
Severity
Moderate
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
- last fix caused a regression, patch was temporary disabled [bsc#1250553]
Patchnames: SUSE-2025-3595,SUSE-SUSE-MicroOS-5.1-2025-3595,SUSE-SUSE-MicroOS-5.2-2025-3595,openSUSE-SLE-15.6-2025-3595
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
10 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\n- last fix caused a regression, patch was temporary disabled [bsc#1250553]\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-3595,SUSE-SUSE-MicroOS-5.1-2025-3595,SUSE-SUSE-MicroOS-5.2-2025-3595,openSUSE-SLE-15.6-2025-3595",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_03595-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:03595-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202503595-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:03595-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2025-October/042166.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-10-14T21:07:48Z",
"generator": {
"date": "2025-10-14T21:07:48Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:03595-1",
"initial_release_date": "2025-10-14T21:07:48Z",
"revision_history": [
{
"date": "2025-10-14T21:07:48Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.25.1.aarch64",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.25.1.aarch64",
"product_id": "libxslt-devel-1.1.32-150000.3.25.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.25.1.aarch64",
"product": {
"name": "libxslt-python-1.1.32-150000.3.25.1.aarch64",
"product_id": "libxslt-python-1.1.32-150000.3.25.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.25.1.aarch64",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.25.1.aarch64",
"product_id": "libxslt-tools-1.1.32-150000.3.25.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.25.1.aarch64",
"product": {
"name": "libxslt1-1.1.32-150000.3.25.1.aarch64",
"product_id": "libxslt1-1.1.32-150000.3.25.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-64bit-1.1.32-150000.3.25.1.aarch64_ilp32",
"product": {
"name": "libxslt-devel-64bit-1.1.32-150000.3.25.1.aarch64_ilp32",
"product_id": "libxslt-devel-64bit-1.1.32-150000.3.25.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libxslt1-64bit-1.1.32-150000.3.25.1.aarch64_ilp32",
"product": {
"name": "libxslt1-64bit-1.1.32-150000.3.25.1.aarch64_ilp32",
"product_id": "libxslt1-64bit-1.1.32-150000.3.25.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.25.1.i586",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.25.1.i586",
"product_id": "libxslt-devel-1.1.32-150000.3.25.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.25.1.i586",
"product": {
"name": "libxslt-python-1.1.32-150000.3.25.1.i586",
"product_id": "libxslt-python-1.1.32-150000.3.25.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.25.1.i586",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.25.1.i586",
"product_id": "libxslt-tools-1.1.32-150000.3.25.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.25.1.i586",
"product": {
"name": "libxslt1-1.1.32-150000.3.25.1.i586",
"product_id": "libxslt1-1.1.32-150000.3.25.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.25.1.ppc64le",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.25.1.ppc64le",
"product_id": "libxslt-devel-1.1.32-150000.3.25.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"product": {
"name": "libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"product_id": "libxslt-python-1.1.32-150000.3.25.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.25.1.ppc64le",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.25.1.ppc64le",
"product_id": "libxslt-tools-1.1.32-150000.3.25.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.25.1.ppc64le",
"product": {
"name": "libxslt1-1.1.32-150000.3.25.1.ppc64le",
"product_id": "libxslt1-1.1.32-150000.3.25.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.25.1.s390x",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.25.1.s390x",
"product_id": "libxslt-devel-1.1.32-150000.3.25.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.25.1.s390x",
"product": {
"name": "libxslt-python-1.1.32-150000.3.25.1.s390x",
"product_id": "libxslt-python-1.1.32-150000.3.25.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.25.1.s390x",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.25.1.s390x",
"product_id": "libxslt-tools-1.1.32-150000.3.25.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.25.1.s390x",
"product": {
"name": "libxslt1-1.1.32-150000.3.25.1.s390x",
"product_id": "libxslt1-1.1.32-150000.3.25.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt-devel-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt-devel-1.1.32-150000.3.25.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-devel-32bit-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt-devel-32bit-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt-devel-32bit-1.1.32-150000.3.25.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-python-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt-python-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt-python-1.1.32-150000.3.25.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt-tools-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt-tools-1.1.32-150000.3.25.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt1-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt1-1.1.32-150000.3.25.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-32bit-1.1.32-150000.3.25.1.x86_64",
"product": {
"name": "libxslt1-32bit-1.1.32-150000.3.25.1.x86_64",
"product_id": "libxslt1-32bit-1.1.32-150000.3.25.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.1",
"product": {
"name": "SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.aarch64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.aarch64"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.s390x as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.s390x"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.x86_64 as component of SUSE Linux Enterprise Micro 5.1",
"product_id": "SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.x86_64"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.aarch64"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.s390x"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.32-150000.3.25.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.x86_64"
},
"product_reference": "libxslt1-1.1.32-150000.3.25.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.25.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.aarch64"
},
"product_reference": "libxslt-python-1.1.32-150000.3.25.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.25.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.ppc64le"
},
"product_reference": "libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.25.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.s390x"
},
"product_reference": "libxslt-python-1.1.32-150000.3.25.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-python-1.1.32-150000.3.25.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.x86_64"
},
"product_reference": "libxslt-python-1.1.32-150000.3.25.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.1:libxslt1-1.1.32-150000.3.25.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxslt1-1.1.32-150000.3.25.1.x86_64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.aarch64",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.ppc64le",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.s390x",
"openSUSE Leap 15.6:libxslt-python-1.1.32-150000.3.25.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-14T21:07:48Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
}
]
}
SUSE-SU-2025:20892-1
Vulnerability from csaf_suse - Published: 2025-10-24 12:52 - Updated: 2025-10-24 12:52Summary
Security update for libxslt
Severity
Moderate
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
- CVE-2025-11731: type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)
- CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)
Patchnames: SUSE-SLE-Micro-6.0-503
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\n- CVE-2025-11731: type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)\n- CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-503",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20892-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20892-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520892-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20892-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023038.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1251979",
"url": "https://bugzilla.suse.com/1251979"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11731 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11731/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-10-24T12:52:51Z",
"generator": {
"date": "2025-10-24T12:52:51Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20892-1",
"initial_release_date": "2025-10-24T12:52:51Z",
"revision_history": [
{
"date": "2025-10-24T12:52:51Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-7.1.aarch64",
"product": {
"name": "libexslt0-1.1.38-7.1.aarch64",
"product_id": "libexslt0-1.1.38-7.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-7.1.aarch64",
"product": {
"name": "libxslt1-1.1.38-7.1.aarch64",
"product_id": "libxslt1-1.1.38-7.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-7.1.s390x",
"product": {
"name": "libexslt0-1.1.38-7.1.s390x",
"product_id": "libexslt0-1.1.38-7.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-7.1.s390x",
"product": {
"name": "libxslt1-1.1.38-7.1.s390x",
"product_id": "libxslt1-1.1.38-7.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-7.1.x86_64",
"product": {
"name": "libexslt0-1.1.38-7.1.x86_64",
"product_id": "libexslt0-1.1.38-7.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-7.1.x86_64",
"product": {
"name": "libxslt1-1.1.38-7.1.x86_64",
"product_id": "libxslt1-1.1.38-7.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-7.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64"
},
"product_reference": "libexslt0-1.1.38-7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-7.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x"
},
"product_reference": "libexslt0-1.1.38-7.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-7.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64"
},
"product_reference": "libexslt0-1.1.38-7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-7.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64"
},
"product_reference": "libxslt1-1.1.38-7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-7.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x"
},
"product_reference": "libxslt1-1.1.38-7.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-7.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
},
"product_reference": "libxslt1-1.1.38-7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-24T12:52:51Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2025-11731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11731"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT \u003cfunc:result\u003e elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11731",
"url": "https://www.suse.com/security/cve/CVE-2025-11731"
},
{
"category": "external",
"summary": "SUSE Bug 1251979 for CVE-2025-11731",
"url": "https://bugzilla.suse.com/1251979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libexslt0-1.1.38-7.1.x86_64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.aarch64",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.s390x",
"SUSE Linux Micro 6.0:libxslt1-1.1.38-7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-24T12:52:51Z",
"details": "important"
}
],
"title": "CVE-2025-11731"
}
]
}
SUSE-SU-2025:20897-1
Vulnerability from csaf_suse - Published: 2025-10-23 12:41 - Updated: 2025-10-23 12:41Summary
Security update for libxslt
Severity
Moderate
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)
- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)
Patchnames: SUSE-SLE-Micro-6.1-318
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\n- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)\n- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-318",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20897-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20897-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520897-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20897-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023117.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1251979",
"url": "https://bugzilla.suse.com/1251979"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11731 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11731/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-10-23T12:41:24Z",
"generator": {
"date": "2025-10-23T12:41:24Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20897-1",
"initial_release_date": "2025-10-23T12:41:24Z",
"revision_history": [
{
"date": "2025-10-23T12:41:24Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"product": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"product_id": "libexslt0-1.1.38-slfo.1.1_5.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"product": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"product_id": "libxslt1-1.1.38-slfo.1.1_5.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"product": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"product_id": "libexslt0-1.1.38-slfo.1.1_5.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"product": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"product_id": "libxslt1-1.1.38-slfo.1.1_5.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"product": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"product_id": "libexslt0-1.1.38-slfo.1.1_5.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"product": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"product_id": "libxslt1-1.1.38-slfo.1.1_5.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"product": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"product_id": "libexslt0-1.1.38-slfo.1.1_5.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.38-slfo.1.1_5.1.x86_64",
"product": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.x86_64",
"product_id": "libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64"
},
"product_reference": "libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le"
},
"product_reference": "libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x"
},
"product_reference": "libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.38-slfo.1.1_5.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64"
},
"product_reference": "libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64"
},
"product_reference": "libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le"
},
"product_reference": "libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x"
},
"product_reference": "libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.38-slfo.1.1_5.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
},
"product_reference": "libxslt1-1.1.38-slfo.1.1_5.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-23T12:41:24Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2025-11731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11731"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT \u003cfunc:result\u003e elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11731",
"url": "https://www.suse.com/security/cve/CVE-2025-11731"
},
{
"category": "external",
"summary": "SUSE Bug 1251979 for CVE-2025-11731",
"url": "https://bugzilla.suse.com/1251979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libexslt0-1.1.38-slfo.1.1_5.1.x86_64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.aarch64",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.ppc64le",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.s390x",
"SUSE Linux Micro 6.1:libxslt1-1.1.38-slfo.1.1_5.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-23T12:41:24Z",
"details": "important"
}
],
"title": "CVE-2025-11731"
}
]
}
SUSE-SU-2025:21008-1
Vulnerability from csaf_suse - Published: 2025-11-19 09:41 - Updated: 2025-11-19 09:41Summary
Security update for libxslt
Severity
Important
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
Changes in libxslt:
- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)
- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)
Patchnames: SUSE-SLES-16.0-24
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
32 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
32 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\nChanges in libxslt:\n\n- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)\n- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-24",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21008-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:21008-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202521008-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:21008-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023384.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1251979",
"url": "https://bugzilla.suse.com/1251979"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11731 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11731/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-11-19T09:41:09Z",
"generator": {
"date": "2025-11-19T09:41:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:21008-1",
"initial_release_date": "2025-11-19T09:41:09Z",
"revision_history": [
{
"date": "2025-11-19T09:41:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.aarch64",
"product_id": "libexslt0-1.1.43-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-devel-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libxslt-devel-1.1.43-160000.3.1.aarch64",
"product_id": "libxslt-devel-1.1.43-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libxslt-tools-1.1.43-160000.3.1.aarch64",
"product_id": "libxslt-tools-1.1.43-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.aarch64",
"product_id": "libxslt1-1.1.43-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.ppc64le",
"product_id": "libexslt0-1.1.43-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-devel-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libxslt-devel-1.1.43-160000.3.1.ppc64le",
"product_id": "libxslt-devel-1.1.43-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libxslt-tools-1.1.43-160000.3.1.ppc64le",
"product_id": "libxslt-tools-1.1.43-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.ppc64le",
"product_id": "libxslt1-1.1.43-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.s390x",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.s390x",
"product_id": "libexslt0-1.1.43-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-devel-1.1.43-160000.3.1.s390x",
"product": {
"name": "libxslt-devel-1.1.43-160000.3.1.s390x",
"product_id": "libxslt-devel-1.1.43-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.43-160000.3.1.s390x",
"product": {
"name": "libxslt-tools-1.1.43-160000.3.1.s390x",
"product_id": "libxslt-tools-1.1.43-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.s390x",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.s390x",
"product_id": "libxslt1-1.1.43-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.x86_64",
"product_id": "libexslt0-1.1.43-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-devel-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libxslt-devel-1.1.43-160000.3.1.x86_64",
"product_id": "libxslt-devel-1.1.43-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libxslt-tools-1.1.43-160000.3.1.x86_64",
"product_id": "libxslt-tools-1.1.43-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.x86_64",
"product_id": "libxslt1-1.1.43-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16.0"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt-devel-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt-tools-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-19T09:41:09Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2025-11731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11731"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT \u003cfunc:result\u003e elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11731",
"url": "https://www.suse.com/security/cve/CVE-2025-11731"
},
{
"category": "external",
"summary": "SUSE Bug 1251979 for CVE-2025-11731",
"url": "https://bugzilla.suse.com/1251979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libxslt1-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-devel-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt-tools-1.1.43-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-19T09:41:09Z",
"details": "important"
}
],
"title": "CVE-2025-11731"
}
]
}
SUSE-SU-2025:21031-1
Vulnerability from csaf_suse - Published: 2025-11-19 09:41 - Updated: 2025-11-19 09:41Summary
Security update for libxslt
Severity
Important
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
Changes in libxslt:
- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)
- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)
Patchnames: SUSE-SL-Micro-6.2-24
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\nChanges in libxslt:\n\n- CVE-2025-11731: Fixed type confusion in exsltFuncResultCompfunction leading to denial of service (bsc#1251979)\n- CVE-2025-10911: Fixed use-after-free with key data stored cross-RVT (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-24",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21031-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:21031-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202521031-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:21031-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023404.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1251979",
"url": "https://bugzilla.suse.com/1251979"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11731 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11731/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-11-19T09:41:09Z",
"generator": {
"date": "2025-11-19T09:41:09Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:21031-1",
"initial_release_date": "2025-11-19T09:41:09Z",
"revision_history": [
{
"date": "2025-11-19T09:41:09Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.aarch64",
"product_id": "libexslt0-1.1.43-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.aarch64",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.aarch64",
"product_id": "libxslt1-1.1.43-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.ppc64le",
"product_id": "libexslt0-1.1.43-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.ppc64le",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.ppc64le",
"product_id": "libxslt1-1.1.43-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.s390x",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.s390x",
"product_id": "libexslt0-1.1.43-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.s390x",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.s390x",
"product_id": "libxslt1-1.1.43-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libexslt0-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libexslt0-1.1.43-160000.3.1.x86_64",
"product_id": "libexslt0-1.1.43-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.43-160000.3.1.x86_64",
"product": {
"name": "libxslt1-1.1.43-160000.3.1.x86_64",
"product_id": "libxslt1-1.1.43-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:transactional"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexslt0-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libexslt0-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.43-160000.3.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
},
"product_reference": "libxslt1-1.1.43-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-19T09:41:09Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2025-11731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11731"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT \u003cfunc:result\u003e elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11731",
"url": "https://www.suse.com/security/cve/CVE-2025-11731"
},
{
"category": "external",
"summary": "SUSE Bug 1251979 for CVE-2025-11731",
"url": "https://bugzilla.suse.com/1251979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libexslt0-1.1.43-160000.3.1.x86_64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.aarch64",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.ppc64le",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.s390x",
"SUSE Linux Micro 6.2:libxslt1-1.1.43-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-19T09:41:09Z",
"details": "important"
}
],
"title": "CVE-2025-11731"
}
]
}
SUSE-SU-2025:3875-1
Vulnerability from csaf_suse - Published: 2025-10-30 15:27 - Updated: 2025-10-30 15:27Summary
Security update for libxslt
Severity
Important
Notes
Title of the patch: Security update for libxslt
Description of the patch: This update for libxslt fixes the following issues:
- CVE-2025-11731: fixed a type confusion in exsltFuncResultComp function leading to denial of service (bsc#1251979)
- CVE-2025-10911: last fix caused a regression, patch was temporary disabled (bsc#1250553)
Patchnames: SUSE-2025-3875,SUSE-SLE-Micro-5.3-2025-3875,SUSE-SLE-Micro-5.4-2025-3875,SUSE-SLE-Micro-5.5-2025-3875,SUSE-SLE-Module-Basesystem-15-SP6-2025-3875,SUSE-SLE-Module-Basesystem-15-SP7-2025-3875,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-3875,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-3875,openSUSE-SLE-15.6-2025-3875
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
50 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
50 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxslt",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxslt fixes the following issues:\n\n - CVE-2025-11731: fixed a type confusion in exsltFuncResultComp function leading to denial of service (bsc#1251979)\n - CVE-2025-10911: last fix caused a regression, patch was temporary disabled (bsc#1250553)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-3875,SUSE-SLE-Micro-5.3-2025-3875,SUSE-SLE-Micro-5.4-2025-3875,SUSE-SLE-Micro-5.5-2025-3875,SUSE-SLE-Module-Basesystem-15-SP6-2025-3875,SUSE-SLE-Module-Basesystem-15-SP7-2025-3875,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-3875,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-3875,openSUSE-SLE-15.6-2025-3875",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_3875-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:3875-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20253875-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:3875-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-October/023084.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1251979",
"url": "https://bugzilla.suse.com/1251979"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11731 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11731/"
}
],
"title": "Security update for libxslt",
"tracking": {
"current_release_date": "2025-10-30T15:27:08Z",
"generator": {
"date": "2025-10-30T15:27:08Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:3875-1",
"initial_release_date": "2025-10-30T15:27:08Z",
"revision_history": [
{
"date": "2025-10-30T15:27:08Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"product": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"product_id": "libxslt-devel-1.1.34-150400.3.13.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"product": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"product_id": "libxslt-tools-1.1.34-150400.3.13.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"product": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"product_id": "libxslt1-1.1.34-150400.3.13.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-64bit-1.1.34-150400.3.13.1.aarch64_ilp32",
"product": {
"name": "libxslt-devel-64bit-1.1.34-150400.3.13.1.aarch64_ilp32",
"product_id": "libxslt-devel-64bit-1.1.34-150400.3.13.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libxslt1-64bit-1.1.34-150400.3.13.1.aarch64_ilp32",
"product": {
"name": "libxslt1-64bit-1.1.34-150400.3.13.1.aarch64_ilp32",
"product_id": "libxslt1-64bit-1.1.34-150400.3.13.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.34-150400.3.13.1.i586",
"product": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.i586",
"product_id": "libxslt-devel-1.1.34-150400.3.13.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.34-150400.3.13.1.i586",
"product": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.i586",
"product_id": "libxslt-tools-1.1.34-150400.3.13.1.i586"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.34-150400.3.13.1.i586",
"product": {
"name": "libxslt1-1.1.34-150400.3.13.1.i586",
"product_id": "libxslt1-1.1.34-150400.3.13.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"product": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"product_id": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"product": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"product_id": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"product": {
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"product_id": "libxslt1-1.1.34-150400.3.13.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.34-150400.3.13.1.s390x",
"product": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.s390x",
"product_id": "libxslt-devel-1.1.34-150400.3.13.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.34-150400.3.13.1.s390x",
"product": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.s390x",
"product_id": "libxslt-tools-1.1.34-150400.3.13.1.s390x"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.34-150400.3.13.1.s390x",
"product": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x",
"product_id": "libxslt1-1.1.34-150400.3.13.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"product": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"product_id": "libxslt-devel-1.1.34-150400.3.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"product": {
"name": "libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"product_id": "libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"product": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"product_id": "libxslt-tools-1.1.34-150400.3.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"product": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"product_id": "libxslt1-1.1.34-150400.3.13.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"product": {
"name": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"product_id": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.3",
"product": {
"name": "SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3",
"product_id": "SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.4",
"product_id": "SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-1.1.34-150400.3.13.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt-tools-1.1.34-150400.3.13.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-1.1.34-150400.3.13.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
},
"product_reference": "libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-30T15:27:08Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2025-11731",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11731"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT \u003cfunc:result\u003e elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11731",
"url": "https://www.suse.com/security/cve/CVE-2025-11731"
},
{
"category": "external",
"summary": "SUSE Bug 1251979 for CVE-2025-11731",
"url": "https://bugzilla.suse.com/1251979"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.3:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.4:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Micro 5.5:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libxslt1-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-devel-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-devel-32bit-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt-tools-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.aarch64",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.ppc64le",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.s390x",
"openSUSE Leap 15.6:libxslt1-1.1.34-150400.3.13.1.x86_64",
"openSUSE Leap 15.6:libxslt1-32bit-1.1.34-150400.3.13.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-30T15:27:08Z",
"details": "important"
}
],
"title": "CVE-2025-11731"
}
]
}
SUSE-SU-2026:0568-1
Vulnerability from csaf_suse - Published: 2026-02-17 12:26 - Updated: 2026-02-17 12:26Summary
Security update for libxml2
Severity
Moderate
Notes
Title of the patch: Security update for libxml2
Description of the patch: This update for libxml2 fixes the following issues:
- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)
- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)
- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)
- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)
Patchnames: SUSE-2026-568,SUSE-SUSE-MicroOS-5.2-2026-568,openSUSE-SLE-15.6-2026-568
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
low
References
25 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libxml2",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libxml2 fixes the following issues:\n\n- CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811)\n- CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812)\n- CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595)\n- CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553)\n ",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-568,SUSE-SUSE-MicroOS-5.2-2026-568,openSUSE-SLE-15.6-2026-568",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0568-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:0568-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260568-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:0568-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024333.html"
},
{
"category": "self",
"summary": "SUSE Bug 1250553",
"url": "https://bugzilla.suse.com/1250553"
},
{
"category": "self",
"summary": "SUSE Bug 1256807",
"url": "https://bugzilla.suse.com/1256807"
},
{
"category": "self",
"summary": "SUSE Bug 1256808",
"url": "https://bugzilla.suse.com/1256808"
},
{
"category": "self",
"summary": "SUSE Bug 1256809",
"url": "https://bugzilla.suse.com/1256809"
},
{
"category": "self",
"summary": "SUSE Bug 1256811",
"url": "https://bugzilla.suse.com/1256811"
},
{
"category": "self",
"summary": "SUSE Bug 1256812",
"url": "https://bugzilla.suse.com/1256812"
},
{
"category": "self",
"summary": "SUSE Bug 1257593",
"url": "https://bugzilla.suse.com/1257593"
},
{
"category": "self",
"summary": "SUSE Bug 1257594",
"url": "https://bugzilla.suse.com/1257594"
},
{
"category": "self",
"summary": "SUSE Bug 1257595",
"url": "https://bugzilla.suse.com/1257595"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-10911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-10911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0990 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0990/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-0992 page",
"url": "https://www.suse.com/security/cve/CVE-2026-0992/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-1757 page",
"url": "https://www.suse.com/security/cve/CVE-2026-1757/"
}
],
"title": "Security update for libxml2",
"tracking": {
"current_release_date": "2026-02-17T12:26:27Z",
"generator": {
"date": "2026-02-17T12:26:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:0568-1",
"initial_release_date": "2026-02-17T12:26:27Z",
"revision_history": [
{
"date": "2026-02-17T12:26:27Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-2.9.7-150000.3.94.1.aarch64",
"product": {
"name": "libxml2-2-2.9.7-150000.3.94.1.aarch64",
"product_id": "libxml2-2-2.9.7-150000.3.94.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxml2-devel-2.9.7-150000.3.94.1.aarch64",
"product": {
"name": "libxml2-devel-2.9.7-150000.3.94.1.aarch64",
"product_id": "libxml2-devel-2.9.7-150000.3.94.1.aarch64"
}
},
{
"category": "product_version",
"name": "libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"product": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"product_id": "libxml2-tools-2.9.7-150000.3.94.1.aarch64"
}
},
{
"category": "product_version",
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"product": {
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"product_id": "python2-libxml2-python-2.9.7-150000.3.94.1.aarch64"
}
},
{
"category": "product_version",
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"product": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"product_id": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-64bit-2.9.7-150000.3.94.1.aarch64_ilp32",
"product": {
"name": "libxml2-2-64bit-2.9.7-150000.3.94.1.aarch64_ilp32",
"product_id": "libxml2-2-64bit-2.9.7-150000.3.94.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libxml2-devel-64bit-2.9.7-150000.3.94.1.aarch64_ilp32",
"product": {
"name": "libxml2-devel-64bit-2.9.7-150000.3.94.1.aarch64_ilp32",
"product_id": "libxml2-devel-64bit-2.9.7-150000.3.94.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-2.9.7-150000.3.94.1.i586",
"product": {
"name": "libxml2-2-2.9.7-150000.3.94.1.i586",
"product_id": "libxml2-2-2.9.7-150000.3.94.1.i586"
}
},
{
"category": "product_version",
"name": "libxml2-devel-2.9.7-150000.3.94.1.i586",
"product": {
"name": "libxml2-devel-2.9.7-150000.3.94.1.i586",
"product_id": "libxml2-devel-2.9.7-150000.3.94.1.i586"
}
},
{
"category": "product_version",
"name": "libxml2-tools-2.9.7-150000.3.94.1.i586",
"product": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.i586",
"product_id": "libxml2-tools-2.9.7-150000.3.94.1.i586"
}
},
{
"category": "product_version",
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.i586",
"product": {
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.i586",
"product_id": "python2-libxml2-python-2.9.7-150000.3.94.1.i586"
}
},
{
"category": "product_version",
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.i586",
"product": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.i586",
"product_id": "python3-libxml2-python-2.9.7-150000.3.94.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-doc-2.9.7-150000.3.94.1.noarch",
"product": {
"name": "libxml2-doc-2.9.7-150000.3.94.1.noarch",
"product_id": "libxml2-doc-2.9.7-150000.3.94.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-2.9.7-150000.3.94.1.ppc64le",
"product": {
"name": "libxml2-2-2.9.7-150000.3.94.1.ppc64le",
"product_id": "libxml2-2-2.9.7-150000.3.94.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxml2-devel-2.9.7-150000.3.94.1.ppc64le",
"product": {
"name": "libxml2-devel-2.9.7-150000.3.94.1.ppc64le",
"product_id": "libxml2-devel-2.9.7-150000.3.94.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libxml2-tools-2.9.7-150000.3.94.1.ppc64le",
"product": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.ppc64le",
"product_id": "libxml2-tools-2.9.7-150000.3.94.1.ppc64le"
}
},
{
"category": "product_version",
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"product": {
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"product_id": "python2-libxml2-python-2.9.7-150000.3.94.1.ppc64le"
}
},
{
"category": "product_version",
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"product": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"product_id": "python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-2.9.7-150000.3.94.1.s390x",
"product": {
"name": "libxml2-2-2.9.7-150000.3.94.1.s390x",
"product_id": "libxml2-2-2.9.7-150000.3.94.1.s390x"
}
},
{
"category": "product_version",
"name": "libxml2-devel-2.9.7-150000.3.94.1.s390x",
"product": {
"name": "libxml2-devel-2.9.7-150000.3.94.1.s390x",
"product_id": "libxml2-devel-2.9.7-150000.3.94.1.s390x"
}
},
{
"category": "product_version",
"name": "libxml2-tools-2.9.7-150000.3.94.1.s390x",
"product": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.s390x",
"product_id": "libxml2-tools-2.9.7-150000.3.94.1.s390x"
}
},
{
"category": "product_version",
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.s390x",
"product": {
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.s390x",
"product_id": "python2-libxml2-python-2.9.7-150000.3.94.1.s390x"
}
},
{
"category": "product_version",
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"product": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"product_id": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-2-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "libxml2-2-2.9.7-150000.3.94.1.x86_64",
"product_id": "libxml2-2-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxml2-2-32bit-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "libxml2-2-32bit-2.9.7-150000.3.94.1.x86_64",
"product_id": "libxml2-2-32bit-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxml2-devel-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "libxml2-devel-2.9.7-150000.3.94.1.x86_64",
"product_id": "libxml2-devel-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxml2-devel-32bit-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "libxml2-devel-32bit-2.9.7-150000.3.94.1.x86_64",
"product_id": "libxml2-devel-32bit-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"product_id": "libxml2-tools-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "python2-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"product_id": "python2-libxml2-python-2.9.7-150000.3.94.1.x86_64"
}
},
{
"category": "product_version",
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"product": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"product_id": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-2-2.9.7-150000.3.94.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64"
},
"product_reference": "libxml2-2-2.9.7-150000.3.94.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-2-2.9.7-150000.3.94.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x"
},
"product_reference": "libxml2-2-2.9.7-150000.3.94.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-2-2.9.7-150000.3.94.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64"
},
"product_reference": "libxml2-2-2.9.7-150000.3.94.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64"
},
"product_reference": "libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x"
},
"product_reference": "libxml2-tools-2.9.7-150000.3.94.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-tools-2.9.7-150000.3.94.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64"
},
"product_reference": "libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
},
"product_reference": "python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-10911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-10911"
}
],
"notes": [
{
"category": "general",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-10911",
"url": "https://www.suse.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "SUSE Bug 1250553 for CVE-2025-10911",
"url": "https://bugzilla.suse.com/1250553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-02-17T12:26:27Z",
"details": "moderate"
}
],
"title": "CVE-2025-10911"
},
{
"cve": "CVE-2026-0990",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0990"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0990",
"url": "https://www.suse.com/security/cve/CVE-2026-0990"
},
{
"category": "external",
"summary": "SUSE Bug 1256806 for CVE-2026-0990",
"url": "https://bugzilla.suse.com/1256806"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-02-17T12:26:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-0990"
},
{
"cve": "CVE-2026-0992",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-0992"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated \u003cnextCatalog\u003e elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-0992",
"url": "https://www.suse.com/security/cve/CVE-2026-0992"
},
{
"category": "external",
"summary": "SUSE Bug 1256808 for CVE-2026-0992",
"url": "https://bugzilla.suse.com/1256808"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-02-17T12:26:27Z",
"details": "moderate"
}
],
"title": "CVE-2026-0992"
},
{
"cve": "CVE-2026-1757",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-1757"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-1757",
"url": "https://www.suse.com/security/cve/CVE-2026-1757"
},
{
"category": "external",
"summary": "SUSE Bug 1257593 for CVE-2026-1757",
"url": "https://bugzilla.suse.com/1257593"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-2-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libxml2-tools-2.9.7-150000.3.94.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"SUSE Linux Enterprise Micro 5.2:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.aarch64",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.ppc64le",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.s390x",
"openSUSE Leap 15.6:python3-libxml2-python-2.9.7-150000.3.94.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-02-17T12:26:27Z",
"details": "low"
}
],
"title": "CVE-2026-1757"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…