p PatchFirst

CVE-2025-7424

CVE-2025-7424 · Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

CVSS 7.5 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libxslt

    Versions
    • ≥ 0, < 1.1.44: Affected (semver)

    Update to 1.1.44

  • red hat enterprise linux 10

    Versions
    • ≥ 0:1.1.39-8.el10_0: Not affected (rpm)

    No fix published

  • red hat hardened images

    Versions
    • ≥ 1.1.45-0.1.hum1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat openshift container platform 4

    No fix published

  • libxslt Debian:12

    Versions
    • 1.1.35-1
    • 1.1.35-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.1.35-1+deb12u2

    Update to 1.1.35-1+deb12u2

  • libxslt Debian:13

    Versions
    • 1.1.35-1.2
    Affected ranges
    • ECOSYSTEM: < 1.1.35-1.2+deb13u1

    Update to 1.1.35-1.2+deb13u1

  • libxslt Debian:14

    Versions
    • 1.1.35-1.2
    Affected ranges
    • ECOSYSTEM: < 1.1.35-2

    Update to 1.1.35-2

  • libxslt Ubuntu:Pro:14.04:LTS

    Versions
    • 1.1.28-2
    • 1.1.28-2build1
    • 1.1.28-2ubuntu0.1
    • 1.1.28-2ubuntu0.2
    • 1.1.28-2ubuntu0.2+esm1
    • 1.1.28-2ubuntu0.2+esm2
    • 1.1.28-2ubuntu0.2+esm3
    • 1.1.28-2ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: < 1.1.28-2ubuntu0.2+esm5

    Update to 1.1.28-2ubuntu0.2+esm5

  • libxslt Ubuntu:Pro:16.04:LTS

    Versions
    • 1.1.28-2build2
    • 1.1.28-2.1
    • 1.1.28-2.1ubuntu0.1
    • 1.1.28-2.1ubuntu0.2
    • 1.1.28-2.1ubuntu0.3
    • 1.1.28-2.1ubuntu0.3+esm1
    • 1.1.28-2.1ubuntu0.3+esm2
    • 1.1.28-2.1ubuntu0.3+esm3
    Affected ranges
    • ECOSYSTEM: < 1.1.28-2.1ubuntu0.3+esm4

    Update to 1.1.28-2.1ubuntu0.3+esm4

  • libxslt Ubuntu:Pro:18.04:LTS

    Versions
    • 1.1.29-2.1ubuntu1
    • 1.1.29-4
    • 1.1.29-5
    • 1.1.29-5ubuntu0.1
    • 1.1.29-5ubuntu0.2
    • 1.1.29-5ubuntu0.3
    • 1.1.29-5ubuntu0.3+esm1
    • 1.1.29-5ubuntu0.3+esm2
    Affected ranges
    • ECOSYSTEM: < 1.1.29-5ubuntu0.3+esm3

    Update to 1.1.29-5ubuntu0.3+esm3

  • libxslt Ubuntu:Pro:20.04:LTS

    Versions
    • 1.1.33-0ubuntu1
    • 1.1.33-0ubuntu2
    • 1.1.33-0ubuntu3
    • 1.1.34-1
    • 1.1.34-1ubuntu1
    • 1.1.34-3
    • 1.1.34-4
    • 1.1.34-4ubuntu0.20.04.1
    • 1.1.34-4ubuntu0.20.04.2
    • 1.1.34-4ubuntu0.20.04.3
    • 1.1.34-4ubuntu0.20.04.3+esm1
    Affected ranges
    • ECOSYSTEM: < 1.1.34-4ubuntu0.20.04.3+esm2

    Update to 1.1.34-4ubuntu0.20.04.3+esm2

  • libxslt Ubuntu:22.04:LTS

    Versions
    • 1.1.34-4
    • 1.1.34-4build1
    • 1.1.34-4build2
    • 1.1.34-4ubuntu0.22.04.1
    • 1.1.34-4ubuntu0.22.04.2
    • 1.1.34-4ubuntu0.22.04.3
    • 1.1.34-4ubuntu0.22.04.4
    Affected ranges
    • ECOSYSTEM: < 1.1.34-4ubuntu0.22.04.5

    Update to 1.1.34-4ubuntu0.22.04.5

  • libxslt Ubuntu:24.04:LTS

    Versions
    • 1.1.35-1
    • 1.1.39-0exp1
    • 1.1.39-0exp1build1
    • 1.1.39-0exp1ubuntu0.24.04.1
    • 1.1.39-0exp1ubuntu0.24.04.2
    Affected ranges
    • ECOSYSTEM: < 1.1.39-0exp1ubuntu0.24.04.3

    Update to 1.1.39-0exp1ubuntu0.24.04.3

Original sources

Check your server →