Bug 2352483 (CVE-2025-24855) - CVE-2025-24855 libxslt: Use-After-Free in libxslt numbers.c
Summary: CVE-2025-24855 libxslt: Use-After-Free in libxslt numbers.c
Keywords:
Status: NEW
Alias: CVE-2025-24855
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2352503 2352505 2352506 2352509 2352512 2352504 2352507 2352508 2352510 2352511
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-03-14 02:01 UTC by OSIDB Bzimport
Modified: 2025-05-15 16:34 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2025:3332 0 None None None 2025-03-27 14:21:36 UTC
Red Hat Product Errata RHBA-2025:3547 0 None None None 2025-04-02 21:29:57 UTC
Red Hat Product Errata RHBA-2025:3672 0 None None None 2025-04-08 08:05:20 UTC
Red Hat Product Errata RHBA-2025:3760 0 None None None 2025-04-09 13:17:14 UTC
Red Hat Product Errata RHBA-2025:3784 0 None None None 2025-04-10 07:27:28 UTC
Red Hat Product Errata RHBA-2025:3785 0 None None None 2025-04-10 07:21:16 UTC
Red Hat Product Errata RHBA-2025:3796 0 None None None 2025-04-10 09:10:10 UTC
Red Hat Product Errata RHBA-2025:3830 0 None None None 2025-04-14 05:57:31 UTC
Red Hat Product Errata RHBA-2025:3950 0 None None None 2025-04-16 14:31:06 UTC
Red Hat Product Errata RHSA-2025:3107 0 None None None 2025-03-24 14:05:22 UTC
Red Hat Product Errata RHSA-2025:3389 0 None None None 2025-03-31 02:04:45 UTC
Red Hat Product Errata RHSA-2025:3528 0 None None None 2025-04-02 14:12:17 UTC
Red Hat Product Errata RHSA-2025:3612 0 None None None 2025-04-07 01:31:51 UTC
Red Hat Product Errata RHSA-2025:3615 0 None None None 2025-04-07 01:45:43 UTC
Red Hat Product Errata RHSA-2025:3619 0 None None None 2025-04-07 01:59:25 UTC
Red Hat Product Errata RHSA-2025:3624 0 None None None 2025-04-07 02:16:20 UTC
Red Hat Product Errata RHSA-2025:3625 0 None None None 2025-04-07 02:14:55 UTC
Red Hat Product Errata RHSA-2025:3626 0 None None None 2025-04-07 02:14:13 UTC
Red Hat Product Errata RHSA-2025:3627 0 None None None 2025-04-07 06:36:14 UTC
Red Hat Product Errata RHSA-2025:4098 0 None None None 2025-04-22 15:29:16 UTC
Red Hat Product Errata RHSA-2025:4422 0 None None None 2025-05-08 19:55:41 UTC
Red Hat Product Errata RHSA-2025:4427 0 None None None 2025-05-09 04:31:18 UTC
Red Hat Product Errata RHSA-2025:4431 0 None None None 2025-05-09 04:33:12 UTC
Red Hat Product Errata RHSA-2025:4677 0 None None None 2025-05-15 16:34:45 UTC
Red Hat Product Errata RHSA-2025:4731 0 None None None 2025-05-15 00:44:35 UTC
Red Hat Product Errata RHSA-2025:7496 0 None None None 2025-05-13 15:59:14 UTC

Description OSIDB Bzimport 2025-03-14 02:01:00 UTC 
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
Comment 2 errata-xmlrpc 2025-03-24 14:05:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:3107 https://access.redhat.com/errata/RHSA-2025:3107
Comment 3 errata-xmlrpc 2025-03-31 02:04:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:3389 https://access.redhat.com/errata/RHSA-2025:3389
Comment 4 errata-xmlrpc 2025-04-02 14:12:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:3528 https://access.redhat.com/errata/RHSA-2025:3528
Comment 5 errata-xmlrpc 2025-04-07 01:31:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:3612 https://access.redhat.com/errata/RHSA-2025:3612
Comment 6 errata-xmlrpc 2025-04-07 01:45:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:3615 https://access.redhat.com/errata/RHSA-2025:3615
Comment 7 errata-xmlrpc 2025-04-07 01:59:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:3619 https://access.redhat.com/errata/RHSA-2025:3619
Comment 8 errata-xmlrpc 2025-04-07 02:14:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2025:3626 https://access.redhat.com/errata/RHSA-2025:3626
Comment 9 errata-xmlrpc 2025-04-07 02:14:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:3625 https://access.redhat.com/errata/RHSA-2025:3625
Comment 10 errata-xmlrpc 2025-04-07 02:16:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:3624 https://access.redhat.com/errata/RHSA-2025:3624
Comment 11 errata-xmlrpc 2025-04-07 06:36:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:3627 https://access.redhat.com/errata/RHSA-2025:3627
Comment 13 errata-xmlrpc 2025-04-22 15:29:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2025:4098 https://access.redhat.com/errata/RHSA-2025:4098
Comment 15 errata-xmlrpc 2025-05-08 19:55:40 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.15

Via RHSA-2025:4422 https://access.redhat.com/errata/RHSA-2025:4422
Comment 16 errata-xmlrpc 2025-05-09 04:31:17 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2025:4427 https://access.redhat.com/errata/RHSA-2025:4427
Comment 17 errata-xmlrpc 2025-05-09 04:33:11 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2025:4431 https://access.redhat.com/errata/RHSA-2025:4431
Comment 18 errata-xmlrpc 2025-05-13 15:59:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:7496 https://access.redhat.com/errata/RHSA-2025:7496
Comment 19 errata-xmlrpc 2025-05-15 00:44:33 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2025:4731 https://access.redhat.com/errata/RHSA-2025:4731
Comment 20 errata-xmlrpc 2025-05-15 16:34:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2025:4677 https://access.redhat.com/errata/RHSA-2025:4677
Note You need to log in before you can comment on or make changes to this bug.