UBUNTU-CVE-2024-40896

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2024-40896
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40896.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-40896
Related
Published
2024-12-23T17:15:00Z
Modified
2025-01-17T08:21:23Z
Summary
[none]
Details

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

References

Affected packages

Ubuntu:24.10 / libxml2

Package

Name
libxml2
Purl
pkg:deb/ubuntu/libxml2@2.12.7+dfsg-3ubuntu0.1?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.12.7+dfsg-3ubuntu0.1

Affected versions

2.*

2.9.14+dfsg-1.3ubuntu3
2.12.7+dfsg-3

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2-dbgsym"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2-dev"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2-doc"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2-utils"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "libxml2-utils-dbgsym"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "python3-libxml2"
        },
        {
            "binary_version": "2.12.7+dfsg-3ubuntu0.1",
            "binary_name": "python3-libxml2-dbgsym"
        }
    ]
}