Vulnerability-Lookup

RHSA-2026:29811

Vulnerability from csaf_redhat - Published: 2026-06-25 09:36 - Updated: 2026-09-01 11:58

Summary

Red Hat Security Advisory: libxslt security update

Severity

Moderate

Notes

Topic: An update for libxslt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: Processing web content may disclose sensitive information (CVE-2023-40403) * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-40403

A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 21 products

Product	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-10911

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 21 products, the same list as for CVE-2023-40403

Threats

Impact Moderate

References

26 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:29811	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2349766	external
https://bugzilla.redhat.com/show_bug.cgi?id=2397838	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-40403	self
https://bugzilla.redhat.com/show_bug.cgi?id=2349766	external
https://www.cve.org/CVERecord?id=CVE-2023-40403	external
https://nvd.nist.gov/vuln/detail/CVE-2023-40403	external
http://seclists.org/fulldisclosure/2023/Oct/10	external
http://seclists.org/fulldisclosure/2023/Oct/3	external
http://seclists.org/fulldisclosure/2023/Oct/4	external
http://seclists.org/fulldisclosure/2023/Oct/5	external
http://seclists.org/fulldisclosure/2023/Oct/6	external
http://seclists.org/fulldisclosure/2023/Oct/8	external
http://seclists.org/fulldisclosure/2023/Oct/9	external
https://bugs.chromium.org/p/chromium/issues/detai…	external
https://bugzilla.gnome.org/show_bug.cgi?id=751621	external
https://gitlab.gnome.org/GNOME/libxslt/-/issues/94	external
https://support.apple.com/en-us/HT213927	external
https://access.redhat.com/security/cve/CVE-2025-10911	self
https://bugzilla.redhat.com/show_bug.cgi?id=2397838	external
https://www.cve.org/CVERecord?id=CVE-2025-10911	external
https://nvd.nist.gov/vuln/detail/CVE-2025-10911	external
https://gitlab.gnome.org/GNOME/libxslt/-/issues/144	external
https://gitlab.gnome.org/GNOME/libxslt/-/merge_re…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libxslt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. \n\nSecurity Fix(es):\n\n* libxslt: Processing web content may disclose sensitive information (CVE-2023-40403)\n\n* libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:29811",
        "url": "https://access.redhat.com/errata/RHSA-2026:29811"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2349766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
      },
      {
        "category": "external",
        "summary": "2397838",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29811.json"
      }
    ],
    "title": "Red Hat Security Advisory: libxslt security update",
    "tracking": {
      "current_release_date": "2026-09-01T11:58:37+00:00",
      "generator": {
        "date": "2026-09-01T11:58:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:29811",
      "initial_release_date": "2026-06-25T09:36:25+00:00",
      "revision_history": [
        {
          "date": "2026-06-25T09:36:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-25T09:36:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-01T11:58:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
                  "product_id": "AppStream-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.s390x",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.s390x",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-devel-0:1.1.34-12.el9_2.s390x",
                "product": {
                  "name": "libxslt-devel-0:1.1.34-12.el9_2.s390x",
                  "product_id": "libxslt-devel-0:1.1.34-12.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-devel@1.1.34-12.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
                "product": {
                  "name": "libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
                  "product_id": "libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.34-12.el9_2?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
                "product": {
                  "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
                  "product_id": "libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.34-12.el9_2?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.x86_64",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.x86_64",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-devel-0:1.1.34-12.el9_2.x86_64",
                "product": {
                  "name": "libxslt-devel-0:1.1.34-12.el9_2.x86_64",
                  "product_id": "libxslt-devel-0:1.1.34-12.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-devel@1.1.34-12.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
                "product": {
                  "name": "libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
                  "product_id": "libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.34-12.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
                "product": {
                  "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
                  "product_id": "libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.34-12.el9_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.i686",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.i686",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-devel-0:1.1.34-12.el9_2.i686",
                "product": {
                  "name": "libxslt-devel-0:1.1.34-12.el9_2.i686",
                  "product_id": "libxslt-devel-0:1.1.34-12.el9_2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-devel@1.1.34-12.el9_2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debugsource-0:1.1.34-12.el9_2.i686",
                "product": {
                  "name": "libxslt-debugsource-0:1.1.34-12.el9_2.i686",
                  "product_id": "libxslt-debugsource-0:1.1.34-12.el9_2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.34-12.el9_2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
                "product": {
                  "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
                  "product_id": "libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.34-12.el9_2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.src",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.src",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.aarch64",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.aarch64",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-devel-0:1.1.34-12.el9_2.aarch64",
                "product": {
                  "name": "libxslt-devel-0:1.1.34-12.el9_2.aarch64",
                  "product_id": "libxslt-devel-0:1.1.34-12.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-devel@1.1.34-12.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
                "product": {
                  "name": "libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
                  "product_id": "libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.34-12.el9_2?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
                "product": {
                  "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
                  "product_id": "libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.34-12.el9_2?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libxslt-0:1.1.34-12.el9_2.ppc64le",
                "product": {
                  "name": "libxslt-0:1.1.34-12.el9_2.ppc64le",
                  "product_id": "libxslt-0:1.1.34-12.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt@1.1.34-12.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
                "product": {
                  "name": "libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
                  "product_id": "libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-devel@1.1.34-12.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
                "product": {
                  "name": "libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
                  "product_id": "libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debugsource@1.1.34-12.el9_2?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
                "product": {
                  "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
                  "product_id": "libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libxslt-debuginfo@1.1.34-12.el9_2?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.src",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-0:1.1.34-12.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64"
        },
        "product_reference": "libxslt-0:1.1.34-12.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64"
        },
        "product_reference": "libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686"
        },
        "product_reference": "libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le"
        },
        "product_reference": "libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x"
        },
        "product_reference": "libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64"
        },
        "product_reference": "libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debugsource-0:1.1.34-12.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64"
        },
        "product_reference": "libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debugsource-0:1.1.34-12.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686"
        },
        "product_reference": "libxslt-debugsource-0:1.1.34-12.el9_2.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le"
        },
        "product_reference": "libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debugsource-0:1.1.34-12.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x"
        },
        "product_reference": "libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-debugsource-0:1.1.34-12.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64"
        },
        "product_reference": "libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-devel-0:1.1.34-12.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64"
        },
        "product_reference": "libxslt-devel-0:1.1.34-12.el9_2.aarch64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-devel-0:1.1.34-12.el9_2.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686"
        },
        "product_reference": "libxslt-devel-0:1.1.34-12.el9_2.i686",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-devel-0:1.1.34-12.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le"
        },
        "product_reference": "libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-devel-0:1.1.34-12.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x"
        },
        "product_reference": "libxslt-devel-0:1.1.34-12.el9_2.s390x",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libxslt-devel-0:1.1.34-12.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
          "product_id": "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
        },
        "product_reference": "libxslt-devel-0:1.1.34-12.el9_2.x86_64",
        "relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40403",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-03-04T12:01:50.826520+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2349766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxslt: Processing web content may disclose sensitive information",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE is a duplicate of CVE-2022-4909.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2349766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/4"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/5"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/6"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/9"
        },
        {
          "category": "external",
          "summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
          "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
          "url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
        },
        {
          "category": "external",
          "summary": "https://support.apple.com/en-us/HT213927",
          "url": "https://support.apple.com/en-us/HT213927"
        }
      ],
      "release_date": "2023-09-26T20:14:54.697000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T09:36:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:29811"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxslt: Processing web content may disclose sensitive information"
    },
    {
      "cve": "CVE-2025-10911",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2025-09-24T12:46:50.095000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2397838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxslt: use-after-free with key data stored cross-RVT",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
          "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
          "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-10911"
        },
        {
          "category": "external",
          "summary": "RHBZ#2397838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-10911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
        }
      ],
      "release_date": "2025-08-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T09:36:25+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:29811"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.src",
            "AppStream-9.2.0.Z.E4S:libxslt-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debuginfo-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-debugsource-0:1.1.34-12.el9_2.x86_64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.aarch64",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.i686",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.ppc64le",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.s390x",
            "AppStream-9.2.0.Z.E4S:libxslt-devel-0:1.1.34-12.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxslt: use-after-free with key data stored cross-RVT"
    }
  ]
}

CVE-2023-40403 (GCVE-0-2023-40403)

Vulnerability from cvelistv5 – Published: 2023-09-26 20:14 – Updated: 2025-11-04 19:18

Summary

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-24 14:28 UTC

CWE

Processing web content may disclose sensitive information

Assigner

apple mitre root

References

21 references

URL	Tags
https://support.apple.com/en-us/HT213938
https://support.apple.com/en-us/HT213932
https://support.apple.com/en-us/HT213927
https://support.apple.com/en-us/HT213931
https://support.apple.com/en-us/HT213936
https://support.apple.com/en-us/HT213940
https://support.apple.com/en-us/HT213937
http://seclists.org/fulldisclosure/2023/Oct/5
http://seclists.org/fulldisclosure/2023/Oct/10
http://seclists.org/fulldisclosure/2023/Oct/6
http://seclists.org/fulldisclosure/2023/Oct/8
http://seclists.org/fulldisclosure/2023/Oct/9
http://seclists.org/fulldisclosure/2023/Oct/3
http://seclists.org/fulldisclosure/2023/Oct/4
https://lists.debian.org/debian-lts-announce/2025…
https://support.apple.com/kb/HT213940
https://support.apple.com/kb/HT213932
https://support.apple.com/kb/HT213931
https://support.apple.com/kb/HT213938
https://support.apple.com/kb/HT213937
https://support.apple.com/kb/HT213936

Impacted products

7 products

Vendor	Product	Version
Apple	iOS and iPadOS	Affected: unspecified , < 17 (custom)
Apple	macOS	Affected: unspecified , < 12.7 (custom)
Apple	iOS and iPadOS	Affected: unspecified , < 16.7 (custom)
Apple	macOS	Affected: unspecified , < 13.6 (custom)
Apple	tvOS	Affected: unspecified , < 17 (custom)
Apple	macOS	Affected: unspecified , < 14 (custom)
Apple	watchOS	Affected: unspecified , < 10 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:18:23.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213938"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213932"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213927"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213931"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213936"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213940"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/en-us/HT213937"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Oct/4"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00024.html"
          },
          {
            "url": "https://support.apple.com/kb/HT213940"
          },
          {
            "url": "https://support.apple.com/kb/HT213932"
          },
          {
            "url": "https://support.apple.com/kb/HT213931"
          },
          {
            "url": "https://support.apple.com/kb/HT213938"
          },
          {
            "url": "https://support.apple.com/kb/HT213937"
          },
          {
            "url": "https://support.apple.com/kb/HT213936"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-40403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T14:28:39.479611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T14:47:30.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "12.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "iOS and iPadOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "16.7",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "13.6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "tvOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "17",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "macOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "14",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "watchOS",
          "vendor": "Apple",
          "versions": [
            {
              "lessThan": "10",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Processing web content may disclose sensitive information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T05:06:43.212Z",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "url": "https://support.apple.com/en-us/HT213938"
        },
        {
          "url": "https://support.apple.com/en-us/HT213932"
        },
        {
          "url": "https://support.apple.com/en-us/HT213927"
        },
        {
          "url": "https://support.apple.com/en-us/HT213931"
        },
        {
          "url": "https://support.apple.com/en-us/HT213936"
        },
        {
          "url": "https://support.apple.com/en-us/HT213940"
        },
        {
          "url": "https://support.apple.com/en-us/HT213937"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/5"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/6"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/9"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2023/Oct/4"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2023-40403",
    "datePublished": "2023-09-26T20:14:54.697Z",
    "dateReserved": "2023-08-14T20:26:36.254Z",
    "dateUpdated": "2025-11-04T19:18:23.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-10911 (GCVE-0-2025-10911)

Vulnerability from cvelistv5 – Published: 2025-09-25 15:13 – Updated: 2026-09-01 11:52

Title

Libxslt: use-after-free with key data stored cross-rvt

Summary

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-29 15:48 UTC

CWE

CWE-825 - Expired Pointer Dereference

Assigner

redhat redhat root

References

18 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:11015	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26355	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28243	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28584	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29807	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29809	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29811	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29814	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29975	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29976	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33313	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-10911	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2397838	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
https://gitlab.gnome.org/GNOME/libxslt/-/merge_re…

Impacted products

21 products

Vendor	Product	Version
		Affected: 0 , ≤ 1.1.43 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.1.39-8.el10_2.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.1.39-8.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.1.32-6.4.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.1.32-8.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:1.1.32-8.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:1.1.32-8.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:1.1.32-8.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:1.1.32-8.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:1.1.32-8.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.1.34-14.el9_8.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.1.34-12.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.1.34-15.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.1.34-13.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Red Hat Discovery 2	Unaffected: 1782756541 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.1.45-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2025-08-04 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10911",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-29T15:48:55.245495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-29T15:49:06.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libxslt",
          "defaultStatus": "unaffected",
          "packageName": "libxslt",
          "versions": [
            {
              "lessThanOrEqual": "1.1.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.39-8.el10_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.39-8.el10_0.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-6.4.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-6.4.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_4.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream",
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.32-8.el8_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.34-14.el9_8.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.34-12.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.34-15.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.34-13.el9_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:discovery:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "discovery/discovery-ui-rhel9",
          "product": "Red Hat Discovery 2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1782756541",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.1.45-0.1.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1784795076",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:rhui:5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhui5/rhua-tp-rhel9",
          "product": "Red Hat Update Infrastructure 5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787241260",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "libxslt",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-08-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-825",
              "description": "Expired Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T11:52:09.894Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:11015",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:11015"
        },
        {
          "name": "RHSA-2026:26355",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26355"
        },
        {
          "name": "RHSA-2026:28243",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28243"
        },
        {
          "name": "RHSA-2026:28584",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28584"
        },
        {
          "name": "RHSA-2026:29807",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29807"
        },
        {
          "name": "RHSA-2026:29809",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29809"
        },
        {
          "name": "RHSA-2026:29811",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29811"
        },
        {
          "name": "RHSA-2026:29814",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29814"
        },
        {
          "name": "RHSA-2026:29975",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29975"
        },
        {
          "name": "RHSA-2026:29976",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:29976"
        },
        {
          "name": "RHSA-2026:30847",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:30847"
        },
        {
          "name": "RHSA-2026:33313",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:33313"
        },
        {
          "name": "RHSA-2026:44481",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:44481"
        },
        {
          "name": "RHSA-2026:58981",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:58981"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-10911"
        },
        {
          "name": "RHBZ#2397838",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-09-24T12:46:50.095Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-08-04T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libxslt: use-after-free with key data stored cross-rvt",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-825: Expired Pointer Dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-10911",
    "datePublished": "2025-09-25T15:13:14.210Z",
    "dateReserved": "2025-09-24T12:45:24.913Z",
    "dateUpdated": "2026-09-01T11:52:09.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:29811

CVE-2023-40403 (GCVE-0-2023-40403)

CVE-2025-10911 (GCVE-0-2025-10911)

Tags

Sightings

Nomenclature

Related by attack behaviour