Bug 2372952 (CVE-2025-6170) - CVE-2025-6170 libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling
Summary: CVE-2025-6170 libxml2: Stack Buffer Overflow in xmllint Interactive Shell Com...
Keywords:
Status: NEW
Alias: CVE-2025-6170
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2372956 2372957 2372958 2372959 2372960 2372961 2372962 2372963 2372964 2372965
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-16 06:00 UTC by OSIDB Bzimport
Modified: 2026-10-08 11:54 UTC (History)
37 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:36734 0 None None None 2026-07-08 14:06:48 UTC
Red Hat Product Errata RHSA-2026:39304 0 None None None 2026-07-14 20:30:04 UTC
Red Hat Product Errata RHSA-2026:39317 0 None None None 2026-07-14 20:30:14 UTC
Red Hat Product Errata RHSA-2026:70596 0 None None None 2026-09-23 07:16:52 UTC
Red Hat Product Errata RHSA-2026:70639 0 None None None 2026-09-23 10:00:07 UTC
Red Hat Product Errata RHSA-2026:79118 0 None None None 2026-10-08 11:44:01 UTC
Red Hat Product Errata RHSA-2026:79119 0 None None None 2026-10-08 11:41:36 UTC
Red Hat Product Errata RHSA-2026:79120 0 None None None 2026-10-08 11:35:47 UTC
Red Hat Product Errata RHSA-2026:79121 0 None None None 2026-10-08 11:54:52 UTC

Description OSIDB Bzimport 2025-06-16 06:00:53 UTC 
Stack-based buffer overflow vulnerability in the interactive shell of the xmllint tool in libxml2. The issue is caused by an unsafe use of strcpy() when processing user-supplied command-line input. When an attacker passes an overly long argument to any shell command (e.g., exit, cat, etc.), the input exceeds the fixed-size stack buffer, resulting in a crash or potentially arbitrary code execution on systems lacking stack protections.
This vulnerability affects only the interactive shell and requires that an attacker can influence or control the command input to xmllint, which is uncommon in typical deployments.
Comment 2 errata-xmlrpc 2026-07-08 14:06:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:36734 https://access.redhat.com/errata/RHSA-2026:36734
Comment 3 errata-xmlrpc 2026-07-14 20:30:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:39304 https://access.redhat.com/errata/RHSA-2026:39304
Comment 4 errata-xmlrpc 2026-07-14 20:30:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:39317 https://access.redhat.com/errata/RHSA-2026:39317
Comment 6 Jon Orris 2026-09-23 07:16:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:70596 https://access.redhat.com/errata/RHSA-2026:70596
Comment 7 Jon Orris 2026-09-23 10:00:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:70639 https://access.redhat.com/errata/RHSA-2026:70639
Comment 8 Jon Orris 2026-10-08 11:35:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:79120 https://access.redhat.com/errata/RHSA-2026:79120
Comment 9 Jon Orris 2026-10-08 11:41:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:79119 https://access.redhat.com/errata/RHSA-2026:79119
Comment 10 Jon Orris 2026-10-08 11:43:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:79118 https://access.redhat.com/errata/RHSA-2026:79118
Comment 11 Jon Orris 2026-10-08 11:54:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:79121 https://access.redhat.com/errata/RHSA-2026:79121
Note You need to log in before you can comment on or make changes to this bug.