CVE-2024-40896
Fixed in a distro release EPSS 1%CVSS 9.1
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Products: libxml2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | openjdk-11-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-17-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-21-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-7-jre | no fix |
| Chainguard | openjdk-8-openj9-dbg | 0.53.0-r1 |
| Red Hat Enterprise Linux 10.0 | libxml2 | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxml2-debuginfo | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxml2-debugsource | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxml2-devel | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxml2-static | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | python3-libxml2 | 0:2.12.5-5.el10_0 |
| Red Hat Enterprise Linux 10.0 | python3-libxml2-debuginfo | 0:2.12.5-5.el10_0 |
| SUSE Linux Micro 6.0 | libxml2 | 2.11.6-4.1 |
| SUSE Linux Micro 6.1 | libxml2 | 2.11.6-slfo.1.1_5.1 |
| SUSE Package Hub 15 SP6 | qt6-webengine | 6.6.3-bp156.2.3.1 |
| SUSE Package Hub 15 SP6 | qt6-webengine-docs | 6.6.3-bp156.2.3.1 |
| Ubuntu 24.10 | libxml2 | 2.12.7+dfsg-3ubuntu0.1 |
| Wolfi | openjdk-7-jre | no fix |
| openSUSE Leap 15.6 | qt6-webengine | 6.6.3-bp156.2.3.1 |
| openSUSE Leap 15.6 | qt6-webengine-docs | 6.6.3-bp156.2.3.1 |
| openSUSE Tumbleweed | libxml2 | 2.12.9-1.1 |
| openSUSE Tumbleweed | qt6-webengine | 6.8.1-2.1 |