Release date:
2026-09-17 14:38:07 UTC
Description:
- CVE-2026-86140: add the missing bounds checks around the two unguarded strcat()
calls in xmlSnprintfElements(), the sibling of the function fixed for
CVE-2025-24928
- CVE-2026-86142: reject a saturated xmlStrlen() result in xmlXPtrEvalXPtrPart()
before it is used to size the XPointer buffer
- CVE-2026-86143: check the xmlBufUse() length against INT_MAX before narrowing it
to the int parameter of the output writecallback, at all six call sites
- CVE-2026-86144: propagate the document parseFlags through xmlXIncludeProcess(),
xmlXIncludeProcessTree() and xmlXIncludeLoadTxt() so XML_PARSE_NONET is honoured
during XInclude resolution
Updated packages:
-
libxml2-2.9.13-12.el9_6.tuxcare.els9.i686.rpm
sha:21981beae531aad8c4f28f80507bb3d6c86a2b753e2e337a7b66c30f9886fd81
-
libxml2-2.9.13-12.el9_6.tuxcare.els9.x86_64.rpm
sha:9d73f62ddf6613b27dbcff4c4a43ed9c0abb6353ddcf8bbf7f43ab7573864f36
-
libxml2-devel-2.9.13-12.el9_6.tuxcare.els9.i686.rpm
sha:db8224bc25d4487129948b28f8f60f731f85238133d9041150662de9f4099563
-
libxml2-devel-2.9.13-12.el9_6.tuxcare.els9.x86_64.rpm
sha:94a260b5f60ac00bb44f2b010308679deda46c8a6b1c9733ae5f57a7e7fdad59
-
libxml2-static-2.9.13-12.el9_6.tuxcare.els9.x86_64.rpm
sha:b5ebb52cf2b39b85972d8363edc1c2adffa97cdaa8575af41a0e7d8d57633dc7
-
python3-libxml2-2.9.13-12.el9_6.tuxcare.els9.x86_64.rpm
sha:771e6c552e21b70fe2137ea27dbcb708797738e4402982e17229e1b51dae283b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
