rpm package
almalinux/libxslt-devel
pkg:rpm/almalinux/libxslt-devel
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-10911 | Med | 5.5 | < 1.1.32-6.4.el8_10 | 1.1.32-6.4.el8_10 | Sep 25, 2025 | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | |
| CVE-2025-24855 | — | < 1.1.34-9.el9_5.1 | 1.1.34-9.el9_5.1 | Mar 14, 2025 | numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. | ||
| CVE-2024-55549 | — | < 1.1.32-6.1.el8_10 | 1.1.32-6.1.el8_10 | Mar 14, 2025 | xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. | ||
| CVE-2023-40403 | — | < 1.1.32-6.2.el8_10 | 1.1.32-6.2.el8_10 | Sep 26, 2023 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information. |
- affected < 1.1.32-6.4.el8_10fixed 1.1.32-6.4.el8_10
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
- CVE-2025-24855Mar 14, 2025affected < 1.1.34-9.el9_5.1fixed 1.1.34-9.el9_5.1
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
- CVE-2024-55549Mar 14, 2025affected < 1.1.32-6.1.el8_10fixed 1.1.32-6.1.el8_10
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
- CVE-2023-40403Sep 26, 2023affected < 1.1.32-6.2.el8_10fixed 1.1.32-6.2.el8_10
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.