Nixpkgs security tracker
8.5 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Libxml2: double-free/uaf in libxml2 python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
References
Affected products
Matching in nixpkgs
pkgs.podman
Program for managing pods, containers and container images
pkgs.libxml2
XML parsing library for C
pkgs.libxml2_13
XML parsing library for C
pkgs.podman-tui
Podman Terminal UI
pkgs.podman-bootc
Streamlining podman+bootc interactions
pkgs.libxml2Python
None
pkgs.cockpit-podman
Cockpit UI for podman containers
pkgs.podman-compose
Implementation of docker-compose with podman backend
pkgs.podman-desktop
Graphical tool for developing on containers and Kubernetes
pkgs.nomad-driver-podman
Podman task driver for Nomad
pkgs.sbclPackages.cl-libxml2
None
-
nixos-unstable -
- nixos-unstable-small 20130615-git
-
nixos-26.05 -
- nixos-26.05-small 20130615-git
pkgs.python313Packages.podman
Python bindings for Podman's RESTful API
pkgs.python314Packages.podman
Python bindings for Podman's RESTful API
pkgs.perlPackages.AlienLibxml2
Install the C libxml2 library on your system
pkgs.python313Packages.libxml2
XML parsing library for C
pkgs.python314Packages.libxml2
XML parsing library for C
pkgs.perl5Packages.AlienLibxml2
Install the C libxml2 library on your system
pkgs.vscode-extensions.sswg.swift-lang
Swift Language Support for Visual Studio Code
Package maintainers
-
@alexandru0-dev Alexandru Nechita <alexandru.italia32+nixpkgs@gmail.com>
-
@andre4ik3 andre4ik3 <andre4ik3@fastmail.com>
-
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@gepbird Gutyina Gergő <gutyina.gergo.2@gmail.com>
-
@cpcloud Phillip Cloud
-
@vdemeester Vincent Demeester <vincent@sbr.pm>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@evan-goode Evan Goode <mail@evangoo.de>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-
@aaronjheng Aaron Jheng <wentworth@outlook.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@nagy Daniel Nagy <danielnagy@posteo.de>
-
@hraban Hraban Luyat <hraban@0brg.net>
-
@lukego Luke Gorrie <luke@snabb.co>
-
@Uthar Kasper Gałkowski <galkowskikasper@gmail.com>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>