p PatchFirst

CVE-2025-9714

CVE-2025-9714 · Stack overflow in libxml2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

CVSS 6.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libxml2

    Versions
    • ≥ 0, < 2.10.0: Affected (semver)
    • ≥ 0, < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3: Affected (dpkg)
    • ≥ 0, < 2.9.14+dfsg-1.3ubuntu3.5: Affected (dpkg)
    • ≥ 0, < 2.9.13+dfsg-1ubuntu0.9: Affected (dpkg)
    • ≥ 0, < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2: Affected (dpkg)
    • ≥ 0, < 2.9.4+dfsg1-6.1ubuntu1.9+esm5: Affected (dpkg)
    • ≥ 0, < 2.9.3+dfsg1-1ubuntu0.7+esm10: Affected (dpkg)
    • ≥ 0, < 2.9.1+dfsg1-3ubuntu4.13+esm9: Affected (dpkg)

    Update to 2.9.14+dfsg-1.3ubuntu3.5

  • libxml2 Debian:12

    Versions
    • 2.9.14+dfsg-1.2
    • 2.9.14+dfsg-1.3~deb12u1
    • 2.9.14+dfsg-1.3~deb12u2
    • 2.9.14+dfsg-1.3~deb12u3
    • 2.9.14+dfsg-1.3~deb12u4
    Affected ranges
    • ECOSYSTEM: < 2.9.14+dfsg-1.3~deb12u5

    Update to 2.9.14+dfsg-1.3~deb12u5

  • libxml2 Debian:13

    Versions
    • 2.12.7+dfsg+really2.9.14-2.1
    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.12.7+dfsg+really2.9.14-2.1+deb13u2

    Update to 2.12.7+dfsg+really2.9.14-2.1+deb13u2

  • libxml2 Debian:14

    Versions
    • 2.12.7+dfsg+really2.9.14-2.1
    • 2.13.1+dfsg-0exp1
    • 2.13.3+dfsg-0exp1
    • 2.13.3+dfsg-0exp2
    • 2.14.1+dfsg-0exp1
    • 2.14.2+dfsg-0exp1
    • 2.14.3+dfsg-0exp1
    • 2.14.3+dfsg-0exp2
    • 2.14.3+dfsg-0exp3
    • 2.14.4+dfsg-0exp1
    • 2.14.5+dfsg-0exp1
    • 2.14.5+dfsg-0exp2
    Affected ranges
    • ECOSYSTEM: < 2.14.5+dfsg-0.1

    Update to 2.14.5+dfsg-0.1

  • libxml2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.9.1+dfsg1-3ubuntu2
    • 2.9.1+dfsg1-3ubuntu3
    • 2.9.1+dfsg1-3ubuntu4
    • 2.9.1+dfsg1-3ubuntu4.1
    • 2.9.1+dfsg1-3ubuntu4.2
    • 2.9.1+dfsg1-3ubuntu4.3
    • 2.9.1+dfsg1-3ubuntu4.4
    • 2.9.1+dfsg1-3ubuntu4.5
    • 2.9.1+dfsg1-3ubuntu4.6
    • 2.9.1+dfsg1-3ubuntu4.7
    • 2.9.1+dfsg1-3ubuntu4.8
    • 2.9.1+dfsg1-3ubuntu4.9
    • 2.9.1+dfsg1-3ubuntu4.10
    • 2.9.1+dfsg1-3ubuntu4.11
    • 2.9.1+dfsg1-3ubuntu4.12
    • 2.9.1+dfsg1-3ubuntu4.13
    • 2.9.1+dfsg1-3ubuntu4.13+esm1
    • 2.9.1+dfsg1-3ubuntu4.13+esm2
    • 2.9.1+dfsg1-3ubuntu4.13+esm3
    • 2.9.1+dfsg1-3ubuntu4.13+esm4
    • 2.9.1+dfsg1-3ubuntu4.13+esm5
    • 2.9.1+dfsg1-3ubuntu4.13+esm6
    • 2.9.1+dfsg1-3ubuntu4.13+esm7
    • 2.9.1+dfsg1-3ubuntu4.13+esm8
    Affected ranges
    • ECOSYSTEM: < 2.9.1+dfsg1-3ubuntu4.13+esm9

    Update to 2.9.1+dfsg1-3ubuntu4.13+esm9

  • libxml2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.9.2+zdfsg1-4
    • 2.9.2+zdfsg1-4ubuntu1
    • 2.9.2+zdfsg1-4ubuntu2
    • 2.9.2+zdfsg1-4ubuntu3
    • 2.9.3+dfsg1-1
    • 2.9.3+dfsg1-1ubuntu0.1
    • 2.9.3+dfsg1-1ubuntu0.2
    • 2.9.3+dfsg1-1ubuntu0.3
    • 2.9.3+dfsg1-1ubuntu0.4
    • 2.9.3+dfsg1-1ubuntu0.5
    • 2.9.3+dfsg1-1ubuntu0.6
    • 2.9.3+dfsg1-1ubuntu0.7
    • 2.9.3+dfsg1-1ubuntu0.7+esm1
    • 2.9.3+dfsg1-1ubuntu0.7+esm2
    • 2.9.3+dfsg1-1ubuntu0.7+esm3
    • 2.9.3+dfsg1-1ubuntu0.7+esm4
    • 2.9.3+dfsg1-1ubuntu0.7+esm5
    • 2.9.3+dfsg1-1ubuntu0.7+esm6
    • 2.9.3+dfsg1-1ubuntu0.7+esm7
    • 2.9.3+dfsg1-1ubuntu0.7+esm8
    • 2.9.3+dfsg1-1ubuntu0.7+esm9
    Affected ranges
    • ECOSYSTEM: < 2.9.3+dfsg1-1ubuntu0.7+esm10

    Update to 2.9.3+dfsg1-1ubuntu0.7+esm10

  • libxml2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.9.4+dfsg1-4ubuntu1
    • 2.9.4+dfsg1-5ubuntu1
    • 2.9.4+dfsg1-5ubuntu2
    • 2.9.4+dfsg1-5.1ubuntu1
    • 2.9.4+dfsg1-5.2ubuntu1
    • 2.9.4+dfsg1-6.1ubuntu1
    • 2.9.4+dfsg1-6.1ubuntu1.2
    • 2.9.4+dfsg1-6.1ubuntu1.3
    • 2.9.4+dfsg1-6.1ubuntu1.4
    • 2.9.4+dfsg1-6.1ubuntu1.5
    • 2.9.4+dfsg1-6.1ubuntu1.6
    • 2.9.4+dfsg1-6.1ubuntu1.7
    • 2.9.4+dfsg1-6.1ubuntu1.8
    • 2.9.4+dfsg1-6.1ubuntu1.9
    • 2.9.4+dfsg1-6.1ubuntu1.9+esm1
    • 2.9.4+dfsg1-6.1ubuntu1.9+esm2
    • 2.9.4+dfsg1-6.1ubuntu1.9+esm3
    • 2.9.4+dfsg1-6.1ubuntu1.9+esm4
    Affected ranges
    • ECOSYSTEM: < 2.9.4+dfsg1-6.1ubuntu1.9+esm5

    Update to 2.9.4+dfsg1-6.1ubuntu1.9+esm5

  • libxml2 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.9.4+dfsg1-7ubuntu3
    • 2.9.4+dfsg1-7ubuntu5
    • 2.9.4+dfsg1-8ubuntu1
    • 2.9.4+dfsg1-8ubuntu2
    • 2.9.4+dfsg1-8ubuntu3
    • 2.9.10+dfsg-1ubuntu3
    • 2.9.10+dfsg-4build1
    • 2.9.10+dfsg-5
    • 2.9.10+dfsg-5ubuntu0.20.04.1
    • 2.9.10+dfsg-5ubuntu0.20.04.2
    • 2.9.10+dfsg-5ubuntu0.20.04.3
    • 2.9.10+dfsg-5ubuntu0.20.04.4
    • 2.9.10+dfsg-5ubuntu0.20.04.5
    • 2.9.10+dfsg-5ubuntu0.20.04.6
    • 2.9.10+dfsg-5ubuntu0.20.04.7
    • 2.9.10+dfsg-5ubuntu0.20.04.8
    • 2.9.10+dfsg-5ubuntu0.20.04.9
    • 2.9.10+dfsg-5ubuntu0.20.04.10
    • 2.9.10+dfsg-5ubuntu0.20.04.10+esm1
    Affected ranges
    • ECOSYSTEM: < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2

    Update to 2.9.10+dfsg-5ubuntu0.20.04.10+esm2

  • libxml2 Ubuntu:22.04:LTS

    Versions
    • 2.9.12+dfsg-4
    • 2.9.12+dfsg-5
    • 2.9.12+dfsg-6
    • 2.9.13+dfsg-1
    • 2.9.13+dfsg-1build1
    • 2.9.13+dfsg-1ubuntu0.1
    • 2.9.13+dfsg-1ubuntu0.2
    • 2.9.13+dfsg-1ubuntu0.3
    • 2.9.13+dfsg-1ubuntu0.4
    • 2.9.13+dfsg-1ubuntu0.5
    • 2.9.13+dfsg-1ubuntu0.6
    • 2.9.13+dfsg-1ubuntu0.7
    • 2.9.13+dfsg-1ubuntu0.8
    Affected ranges
    • ECOSYSTEM: < 2.9.13+dfsg-1ubuntu0.9

    Update to 2.9.13+dfsg-1ubuntu0.9

  • libxml2 Ubuntu:24.04:LTS

    Versions
    • 2.9.14+dfsg-1.3
    • 2.9.14+dfsg-1.3build1
    • 2.9.14+dfsg-1.3build2
    • 2.9.14+dfsg-1.3build3
    • 2.9.14+dfsg-1.3ubuntu1
    • 2.9.14+dfsg-1.3ubuntu2
    • 2.9.14+dfsg-1.3ubuntu3
    • 2.9.14+dfsg-1.3ubuntu3.1
    • 2.9.14+dfsg-1.3ubuntu3.2
    • 2.9.14+dfsg-1.3ubuntu3.3
    • 2.9.14+dfsg-1.3ubuntu3.4
    Affected ranges
    • ECOSYSTEM: < 2.9.14+dfsg-1.3ubuntu3.5

    Update to 2.9.14+dfsg-1.3ubuntu3.5

Original sources

Check your server →