Red Hat Product Errata RHSA-2025:12240 - Security Advisory
Issued:
2025-07-30
Updated:
2025-07-30

RHSA-2025:12240 - Security Advisory

Synopsis

Important: libxml2 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libxml2 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

  • libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414)
  • libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
  • libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
  • libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2358121 - CVE-2025-32414 libxml2: Out-of-Bounds Read in libxml2
  • BZ - 2372373 - CVE-2025-49794 libxml: Heap use after free (UAF) leads to Denial of service (DoS)
  • BZ - 2372385 - CVE-2025-49796 libxml: Type confusion leads to Denial of service (DoS)
  • BZ - 2372406 - CVE-2025-6021 libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
libxml2-2.9.1-6.el7_9.10.src.rpm SHA-256: 4d075a87fead64e876e4fa6fdd8ac88b7b222a56b525b75ed6931afc33542c2a
x86_64
libxml2-2.9.1-6.el7_9.10.i686.rpm SHA-256: fe25701af22327b6fc3300523aa97f02ac8781db2762d610cd796387b26edfc1
libxml2-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: 791804cbafbb21e0abd5868c3f8c34e8631e75449781f931d93ed46184355e37
libxml2-debuginfo-2.9.1-6.el7_9.10.i686.rpm SHA-256: dd9f58d0dddc9d8eb6f952492e3578e5b6711f9fe8ff56822ac593f1c9386db6
libxml2-debuginfo-2.9.1-6.el7_9.10.i686.rpm SHA-256: dd9f58d0dddc9d8eb6f952492e3578e5b6711f9fe8ff56822ac593f1c9386db6
libxml2-debuginfo-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: d48686e8441517a5a6549bf5ea950f32f86221ce3a4b4bb08c48a7ef7ade5f4e
libxml2-debuginfo-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: d48686e8441517a5a6549bf5ea950f32f86221ce3a4b4bb08c48a7ef7ade5f4e
libxml2-devel-2.9.1-6.el7_9.10.i686.rpm SHA-256: 1988af06133582eebded431dc9e2ba562cbd0ce4f787f09b9b1cc5006a4c6c77
libxml2-devel-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: 04b666e2bb685abf85ba2100e2708b31eb3ae29082e9034b11bb684ed16e64c0
libxml2-python-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: 7edcb15feff911f361d3e0657c2fe653b0730c0736e846ec0296614c715925c5
libxml2-static-2.9.1-6.el7_9.10.i686.rpm SHA-256: ef88d51c301ba43cb88742845fba33bc46b72ac64d1c55029331618993316d57
libxml2-static-2.9.1-6.el7_9.10.x86_64.rpm SHA-256: 1820294079647bdd4e1bfb3e393ae0a837a61ce3ee6d45152a5df0d70b155a88

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
libxml2-2.9.1-6.el7_9.10.src.rpm SHA-256: 4d075a87fead64e876e4fa6fdd8ac88b7b222a56b525b75ed6931afc33542c2a
s390x
libxml2-2.9.1-6.el7_9.10.s390.rpm SHA-256: 1461f65ccdad2ab66f9cebfaec022f3296d838cb47990523ba6f5c2b88a0ba0a
libxml2-2.9.1-6.el7_9.10.s390x.rpm SHA-256: 1dac08fab03297eeac8d2df8586a1382ec73110efda174c44fd1f1201c45aa50
libxml2-debuginfo-2.9.1-6.el7_9.10.s390.rpm SHA-256: 1f49430977902418a80ffa80b893f47e2d61f887f5c1d282caaab13225c1b8fc
libxml2-debuginfo-2.9.1-6.el7_9.10.s390.rpm SHA-256: 1f49430977902418a80ffa80b893f47e2d61f887f5c1d282caaab13225c1b8fc
libxml2-debuginfo-2.9.1-6.el7_9.10.s390x.rpm SHA-256: c2ed06a02a1b99be35b79f577620d0150cf60bc1f71bbad03d74a7c921d6f28b
libxml2-debuginfo-2.9.1-6.el7_9.10.s390x.rpm SHA-256: c2ed06a02a1b99be35b79f577620d0150cf60bc1f71bbad03d74a7c921d6f28b
libxml2-devel-2.9.1-6.el7_9.10.s390.rpm SHA-256: d97f50400bbad5bfd8499493347b8a24b5a57d7db4628a0ba29b971c76e34c24
libxml2-devel-2.9.1-6.el7_9.10.s390x.rpm SHA-256: bce886b6586c54a526c6b159b667ffee4160c73c7902bb6fa5ab51d164537dc8
libxml2-python-2.9.1-6.el7_9.10.s390x.rpm SHA-256: 5a27fb7a06ed0f7957da73edd12f4b2d0508608e7957340cddaceabc2e13cb0e
libxml2-static-2.9.1-6.el7_9.10.s390.rpm SHA-256: 8fcda3d9c4c68a1f8110a7ca7a09c31ce9f7479fce3f5cdfea05e4195298d283
libxml2-static-2.9.1-6.el7_9.10.s390x.rpm SHA-256: 57df0c011c6089aced6a221ea36e98c5e29ec27cb9d35fa511fd95b2d8398db8

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
libxml2-2.9.1-6.el7_9.10.src.rpm SHA-256: 4d075a87fead64e876e4fa6fdd8ac88b7b222a56b525b75ed6931afc33542c2a
ppc64
libxml2-2.9.1-6.el7_9.10.ppc.rpm SHA-256: 1eadb870bd2b8d37719bba1cd10c352adcf72b9e9518d7e88727cd104614094b
libxml2-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: 8a9d15fa27fc412736cfffd4e65c2842cf36cda38334b074350f8f8b6b7bc398
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc.rpm SHA-256: b2ec96e1162b98a3344dd852d94fd44f10387e9ac6795dc482f22ce73536df6f
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc.rpm SHA-256: b2ec96e1162b98a3344dd852d94fd44f10387e9ac6795dc482f22ce73536df6f
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: e1b3125cccac071d87573ef61591c81058946954423ee3479908a32d3c3ad667
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: e1b3125cccac071d87573ef61591c81058946954423ee3479908a32d3c3ad667
libxml2-devel-2.9.1-6.el7_9.10.ppc.rpm SHA-256: 9dce11c152e4deeefe7f8d624e9565f0de22b299b514eef295a5b39b1ff6049b
libxml2-devel-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: 6bf72e43f35e476c8834683be113ec37d45d51b24df0c63139e7660d98501171
libxml2-python-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: 3d73dbb9832bdf296fdf0137057d6c745a056b87d5f4a393a0bf454f18f0052a
libxml2-static-2.9.1-6.el7_9.10.ppc.rpm SHA-256: ac2b9de955272c3469c16803bb0b72e7fccfb0161a5b3b4aa7895505eb8534a1
libxml2-static-2.9.1-6.el7_9.10.ppc64.rpm SHA-256: e5c4a3a34cceedf1d3effbb17b4319cd216a227854242a8324f2d40cb33a6744

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
libxml2-2.9.1-6.el7_9.10.src.rpm SHA-256: 4d075a87fead64e876e4fa6fdd8ac88b7b222a56b525b75ed6931afc33542c2a
ppc64le
libxml2-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: 6746254c7dc2341cda48100320010ad2bd921a7614fe6bda94e8122152ef4408
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: fcbf76179bd34eadc90e7b689bf89e9d9246173f6a5d0ca9def77776adb9ff34
libxml2-debuginfo-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: fcbf76179bd34eadc90e7b689bf89e9d9246173f6a5d0ca9def77776adb9ff34
libxml2-devel-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: d5c50043a33e48d53002a245b25d656b09f41df3312646eb58e4af77d50edbf2
libxml2-python-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: 0eea8b8fe48342544941579b69706eee58a828848a895894ca3f6115fc5f1884
libxml2-static-2.9.1-6.el7_9.10.ppc64le.rpm SHA-256: 9652c941e53228f0bbc2c168eba1c3cf8ee606f14e3a1b6e08211d6ce97178f2

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.