CVE-2025-49794

{"id": "CVE-2025-49794", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-06-16T16:15:18.997", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:10630", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:10698", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:10699", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:11580", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12098", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12099", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12199", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12237", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12239", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12240", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:12241", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:13335", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:15397", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:15827", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:15828", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:18217", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:18218", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:18219", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:18240", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:19020", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:19041", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:19046", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:19894", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:21913", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:0934", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:7519", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-49794", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931", "source": "secalert@redhat.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path=\"...\"/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad de use-after-free en libxml2. Este problema se produce al analizar elementos XPath en ciertas circunstancias cuando el esquema XML contiene los elementos de esquema . Esta falla permite a un actor malicioso manipular un documento XML malicioso que se utiliza como entrada para libxml, lo que provoca el bloqueo del programa al usar libxml u otros posibles comportamientos indefinidos."}], "lastModified": "2026-06-02T14:16:34.390", "sourceIdentifier": "secalert@redhat.com"}