CVE-2025-24855
Fixed in a distro release EPSS <1%CVSS 7.8
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
Products: xmlsoft libxslt
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | libxslt | 1.1.39-7.el10_0 |
| AlmaLinux 10 | libxslt-devel | 1.1.39-7.el10_0 |
| AlmaLinux 8 | libxslt | 1.1.32-6.1.el8_10 |
| AlmaLinux 8 | libxslt-devel | 1.1.32-6.1.el8_10 |
| AlmaLinux 9 | libxslt | 1.1.34-9.el9_5.1 |
| AlmaLinux 9 | libxslt-devel | 1.1.34-9.el9_5.1 |
| Alpine 3.18 | libxslt | 1.1.38-r1 |
| Alpine 3.19 | libxslt | 1.1.39-r1 |
| Alpine 3.20 | libxslt | 1.1.39-r2 |
| Alpine 3.21 | libxslt | 1.1.42-r2 |
| Alpine 3.22 | libxslt | 1.1.43-r0 |
| Alpine 3.23 | libxslt | 1.1.43-r0 |
| Alpine 3.24 | libxslt | 1.1.43-r0 |
| Amazon Linux 2 | libxslt | 1.1.28-6.amzn2.0.3 |
| Amazon Linux 2 | libxslt-devel | 1.1.28-6.amzn2.0.3 |
| Amazon Linux 2 | libxslt-python | 1.1.28-6.amzn2.0.3 |
| Amazon Linux 2023 | libxslt | 1.1.43-1.amzn2023.0.1 |
| Amazon Linux 2023 | libxslt-devel | 1.1.43-1.amzn2023.0.1 |
| Amazon Linux 2023 | python3-libxslt | 1.1.43-1.amzn2023.0.1 |
| Chainguard | openjdk-11-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-17-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-21-openj9-default-policy | 0.53.0-r0 |
| Chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-7-jre | no fix |
| Chainguard | openjdk-8-openj9-dbg | 0.53.0-r1 |
| Debian 11 | libxslt | 1.1.34-4+deb11u2 |
| Debian 12 | libxslt | 1.1.35-1+deb12u1 |
| Debian 13 | libxslt | 1.1.35-1.2 |
| Debian 14 | libxslt | 1.1.35-1.2 |
| Red Hat Enterprise Linux 10.0 | libxslt | 0:1.1.39-7.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxslt-debuginfo | 0:1.1.39-7.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxslt-debugsource | 0:1.1.39-7.el10_0 |
| Red Hat Enterprise Linux 10.0 | libxslt-devel | 0:1.1.39-7.el10_0 |
| Red Hat Enterprise Linux 8 | libxslt | 0:1.1.32-6.1.el8_10 |
| Red Hat Enterprise Linux 8 | libxslt-debuginfo | 0:1.1.32-6.1.el8_10 |
| Red Hat Enterprise Linux 8 | libxslt-debugsource | 0:1.1.32-6.1.el8_10 |
| Red Hat Enterprise Linux 8 | libxslt-devel | 0:1.1.32-6.1.el8_10 |
| Red Hat Enterprise Linux 9 | libxslt | 0:1.1.34-9.el9_5.1 |
| Red Hat Enterprise Linux 9 | libxslt-debuginfo | 0:1.1.34-9.el9_5.1 |
| Red Hat Enterprise Linux 9 | libxslt-debugsource | 0:1.1.34-9.el9_5.1 |
| Red Hat Enterprise Linux 9 | libxslt-devel | 0:1.1.34-9.el9_5.1 |
| Red Hat rhel aus 8.2 | libxslt | 0:1.1.32-6.el8_2 |
| Red Hat rhel aus 8.2 | libxslt-debuginfo | 0:1.1.32-6.el8_2 |
| Red Hat rhel aus 8.2 | libxslt-debugsource | 0:1.1.32-6.el8_2 |
| Red Hat rhel aus 8.2 | libxslt-devel | 0:1.1.32-6.el8_2 |
| Red Hat rhel aus 8.4 | libxslt | 0:1.1.32-8.el8_4 |
| Red Hat rhel aus 8.4 | libxslt-debuginfo | 0:1.1.32-8.el8_4 |
| Red Hat rhel aus 8.4 | libxslt-debugsource | 0:1.1.32-8.el8_4 |
| Red Hat rhel aus 8.4 | libxslt-devel | 0:1.1.32-8.el8_4 |
| Red Hat rhel aus 8.6 | libxslt | 0:1.1.32-8.el8_6 |
| Red Hat rhel aus 8.6 | libxslt-debuginfo | 0:1.1.32-8.el8_6 |
| Red Hat rhel aus 8.6 | libxslt-debugsource | 0:1.1.32-8.el8_6 |
| Red Hat rhel aus 8.6 | libxslt-devel | 0:1.1.32-8.el8_6 |
| Red Hat rhel e4s 8.4 | libxslt | 0:1.1.32-8.el8_4 |
| Red Hat rhel e4s 8.4 | libxslt-debuginfo | 0:1.1.32-8.el8_4 |
| Red Hat rhel e4s 8.4 | libxslt-debugsource | 0:1.1.32-8.el8_4 |
| Red Hat rhel e4s 8.4 | libxslt-devel | 0:1.1.32-8.el8_4 |
| Red Hat rhel e4s 8.6 | libxslt | 0:1.1.32-8.el8_6 |
| Red Hat rhel e4s 8.6 | libxslt-debuginfo | 0:1.1.32-8.el8_6 |
| Red Hat rhel e4s 8.6 | libxslt-debugsource | 0:1.1.32-8.el8_6 |
| Red Hat rhel e4s 8.6 | libxslt-devel | 0:1.1.32-8.el8_6 |
| Red Hat rhel e4s 9.0 | libxslt | 0:1.1.34-11.el9_0 |
| Red Hat rhel e4s 9.0 | libxslt-debuginfo | 0:1.1.34-11.el9_0 |
| Red Hat rhel e4s 9.0 | libxslt-debugsource | 0:1.1.34-11.el9_0 |
| Red Hat rhel e4s 9.0 | libxslt-devel | 0:1.1.34-11.el9_0 |
| Red Hat rhel els 7 | libxslt | 0:1.1.28-9.el7_9 |
| Red Hat rhel els 7 | libxslt-debuginfo | 0:1.1.28-9.el7_9 |
| Red Hat rhel els 7 | libxslt-devel | 0:1.1.28-9.el7_9 |
| Red Hat rhel els 7 | libxslt-python | 0:1.1.28-9.el7_9 |
| Red Hat rhel eus 8.8 | libxslt | 0:1.1.32-8.el8_8 |
| Red Hat rhel eus 8.8 | libxslt-debuginfo | 0:1.1.32-8.el8_8 |
| Red Hat rhel eus 8.8 | libxslt-debugsource | 0:1.1.32-8.el8_8 |
| Red Hat rhel eus 8.8 | libxslt-devel | 0:1.1.32-8.el8_8 |
| Red Hat rhel eus 9.2 | libxslt | 0:1.1.34-10.el9_2 |
| Red Hat rhel eus 9.2 | libxslt-debuginfo | 0:1.1.34-10.el9_2 |
| Red Hat rhel eus 9.2 | libxslt-debugsource | 0:1.1.34-10.el9_2 |
| Red Hat rhel eus 9.2 | libxslt-devel | 0:1.1.34-10.el9_2 |
| Red Hat rhel eus 9.4 | libxslt | 0:1.1.34-10.el9_4 |
| Red Hat rhel eus 9.4 | libxslt-debuginfo | 0:1.1.34-10.el9_4 |
| Red Hat rhel eus 9.4 | libxslt-debugsource | 0:1.1.34-10.el9_4 |
| Red Hat rhel eus 9.4 | libxslt-devel | 0:1.1.34-10.el9_4 |
| Red Hat rhel tus 8.4 | libxslt | 0:1.1.32-8.el8_4 |
| Red Hat rhel tus 8.4 | libxslt-debuginfo | 0:1.1.32-8.el8_4 |
| Red Hat rhel tus 8.4 | libxslt-debugsource | 0:1.1.32-8.el8_4 |
| Red Hat rhel tus 8.4 | libxslt-devel | 0:1.1.32-8.el8_4 |
| Red Hat rhel tus 8.6 | libxslt | 0:1.1.32-8.el8_6 |
| Red Hat rhel tus 8.6 | libxslt-debuginfo | 0:1.1.32-8.el8_6 |
| Red Hat rhel tus 8.6 | libxslt-debugsource | 0:1.1.32-8.el8_6 |
| Red Hat rhel tus 8.6 | libxslt-devel | 0:1.1.32-8.el8_6 |
| Rocky Linux 10 | libxslt | 0:1.1.39-7.el10_0 |
| Rocky Linux 8 | libxslt | 0:1.1.32-6.1.el8_10 |
| SUSE Enterprise Storage 7.1 | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Micro 5.1 | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise Micro 5.2 | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise Micro 5.3 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Micro 5.4 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Micro 5.5 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | libxslt | 1.1.28-17.18.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | libxslt | 1.1.28-17.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | libxslt | 1.1.32-150000.3.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Linux Micro 6.0 | libxslt | 1.1.38-4.1 |
| SUSE Linux Micro 6.1 | libxslt | 1.1.38-slfo.1.1_2.1 |
| SUSE Manager Proxy 4.3 | libxslt | 1.1.34-150400.3.6.1 |
| SUSE Manager Server 4.3 | libxslt | 1.1.34-150400.3.6.1 |
| Ubuntu 20.04 LTS | libxslt | 1.1.34-4ubuntu0.20.04.3 |
| Ubuntu 22.04 LTS | libxslt | 1.1.34-4ubuntu0.22.04.3 |
| Ubuntu 24.04 LTS | libxslt | 1.1.39-0exp1ubuntu0.24.04.2 |
| Ubuntu Pro 14.04 LTS | libxslt | 1.1.28-2ubuntu0.2+esm4 |
| Ubuntu Pro 16.04 LTS | libxslt | 1.1.28-2.1ubuntu0.3+esm3 |
| Ubuntu Pro 18.04 LTS | libxslt | 1.1.29-5ubuntu0.3+esm2 |
| Wolfi | openjdk-7-jre | no fix |
| openSUSE Leap 15.6 | libxslt | 1.1.34-150400.3.6.1 |
| openSUSE Leap 15.6 | libxslt-python | 1.1.32-150000.3.17.1 |
| openSUSE Tumbleweed | libqt5-qtwebengine | 5.15.19-1.1 |
| openSUSE Tumbleweed | libxslt | 1.1.43-1.1 |