Bug 2379274 (CVE-2025-7425)

Summary:	CVE-2025-7425 libxslt: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	caswilli, kaycoth
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2379277, 2379278, 2379279, 2379280, 2379284, 2379285, 2379286, 2379281, 2379282, 2379283
Bug Blocks:

Description OSIDB Bzimport 2025-07-10 09:47:37 UTC

Use-After-Free vulnerability in libxslt caused by unsafe manipulation of the atype field in attribute nodes. The flaw occurs when xsltSetSourceNodeFlags() sets extra flag bits on xmlAttrPtr->atype, a field later used by libxml2 to check whether an attribute is an XML ID. This corruption can cause libxml2 to skip cleanup steps like xmlRemoveID() during memory deallocation. As a result, ID table entries may point to freed memory, and later calls to xmlFreeID() will dereference these dangling pointers, triggering a use-after-free. This vulnerability is exploitable through crafted XSLT using the key() function and result tree fragments, and may result in denial-of-service or memory corruption.

Comment 1 errata-xmlrpc 2025-07-31 15:56:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:12447 https://access.redhat.com/errata/RHSA-2025:12447

Comment 2 errata-xmlrpc 2025-07-31 16:20:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:12450 https://access.redhat.com/errata/RHSA-2025:12450

Comment 3 errata-xmlrpc 2025-08-07 04:40:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:13309 https://access.redhat.com/errata/RHSA-2025:13309

Comment 4 errata-xmlrpc 2025-08-07 04:42:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:13308 https://access.redhat.com/errata/RHSA-2025:13308

Comment 5 errata-xmlrpc 2025-08-07 04:44:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:13310 https://access.redhat.com/errata/RHSA-2025:13310

Comment 6 errata-xmlrpc 2025-08-07 05:18:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:13311 https://access.redhat.com/errata/RHSA-2025:13311

Comment 7 errata-xmlrpc 2025-08-07 05:19:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:13313 https://access.redhat.com/errata/RHSA-2025:13313

Comment 8 errata-xmlrpc 2025-08-07 05:23:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:13312 https://access.redhat.com/errata/RHSA-2025:13312

Comment 9 errata-xmlrpc 2025-08-07 05:25:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:13314 https://access.redhat.com/errata/RHSA-2025:13314

Comment 11 errata-xmlrpc 2025-08-07 16:00:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:13464 https://access.redhat.com/errata/RHSA-2025:13464

Comment 14 errata-xmlrpc 2025-08-27 21:45:18 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2025:14059 https://access.redhat.com/errata/RHSA-2025:14059

Comment 15 errata-xmlrpc 2025-08-27 21:45:58 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2025:14396 https://access.redhat.com/errata/RHSA-2025:14396

Comment 16 errata-xmlrpc 2025-09-02 19:23:53 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2025:14819 https://access.redhat.com/errata/RHSA-2025:14819

Comment 25 errata-xmlrpc 2025-09-04 17:01:54 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2025:14818 https://access.redhat.com/errata/RHSA-2025:14818

Comment 26 errata-xmlrpc 2025-09-04 17:04:24 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2025:14853 https://access.redhat.com/errata/RHSA-2025:14853

Comment 27 errata-xmlrpc 2025-09-04 17:04:41 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2025:14858 https://access.redhat.com/errata/RHSA-2025:14858

Comment 36 errata-xmlrpc 2025-09-11 12:01:08 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2025:15308 https://access.redhat.com/errata/RHSA-2025:15308

Comment 37 errata-xmlrpc 2025-09-15 15:13:23 UTC

This issue has been addressed in the following products:

  Red Hat Web Terminal 1.12 on RHEL 9

Via RHSA-2025:15827 https://access.redhat.com/errata/RHSA-2025:15827

Comment 38 errata-xmlrpc 2025-09-15 15:14:11 UTC

This issue has been addressed in the following products:

  Red Hat Web Terminal 1.11 on RHEL 9

Via RHSA-2025:15828 https://access.redhat.com/errata/RHSA-2025:15828

Comment 39 errata-xmlrpc 2025-09-18 05:45:12 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2025:15672 https://access.redhat.com/errata/RHSA-2025:15672