Release date:
2026-09-18 15:14:56 UTC
Description:
* SECURITY UPDATE: heap buffer overflow in the XML dictionary QName
interning path
- debian/patches/CVE-2026-86138.patch: Add integer overflow checks to the
pool size calculation in xmlDictAddQString() in dict.c, and cap the
prefix and name lengths in xmlDictQLookup() so the sum namelen + plen + 1
cannot wrap and undersize the pool allocation
- CVE-2026-86138
Updated packages:
-
libxml2_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_amd64.deb
sha:8b98c81824f4566a2286ce82a96496c217e85c88
-
libxml2-dev_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_amd64.deb
sha:75302679543fdf096dbb6a1cf5c1beae6cc1472c
-
libxml2-doc_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_all.deb
sha:b98ac6105e1a3d16ecb1117c2e47ff023bf8e663
-
libxml2-utils_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_amd64.deb
sha:953ef41b9f4191a65902d0098c5fec5e36692e44
-
python-libxml2_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_amd64.deb
sha:dfaf1616a805eab9179f5163066f0d0e4246303c
-
python3-libxml2_2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11_amd64.deb
sha:0c368562d1d98528cbd95a4e97e7db44107826d2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
