Release date:
2026-09-18 08:11:24 UTC
Description:
* SECURITY UPDATE: integer overflow leading to heap buffer overflow in
xmlDictAddQString()
- debian/patches/CVE-2026-86138.patch: add SIZE_MAX-based overflow guards to
the pool size computation in xmlDictAddQString() in dict.c, plus a
SIZE_MAX fallback define, so an oversized prefix and name can no longer
wrap the allocation size and let the following memcpy() write past the
dictionary string pool
- CVE-2026-86138
Updated packages:
-
libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_amd64.deb
sha:3dd553f532998ad2303c798c7ce701c4edd8482c
-
libxml2-dev_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_amd64.deb
sha:cfaeedbfa8cbc7d079e4c3530298183bfa5ccd1e
-
libxml2-doc_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_all.deb
sha:4604ad216251db5c03fcf79b7012e70b1c53454f
-
libxml2-utils_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_amd64.deb
sha:3802df4a0ce7ccc96e9919cc5a9bd40807f11394
-
python-libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_amd64.deb
sha:f2e3b4869a7a61e3afe493a9b5168dffa775a399
-
python3-libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_amd64.deb
sha:0df7932a10a2757bf8d09afe92cf9d2e6c2d9e9a
-
libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_arm64.deb
sha:99da4ac7b5a9d3b01dee4cc3851b4724c72beb0d
-
libxml2-dev_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_arm64.deb
sha:dc398cb7272c6b4bfe6afe5ddce94792dc6bb4fa
-
libxml2-utils_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_arm64.deb
sha:5e226c31ded37f351d0e50615304f9817bee5e9a
-
python-libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_arm64.deb
sha:588717c9540c36fe05363d4963f94565dcaf61b9
-
python3-libxml2_2.9.10+dfsg-5ubuntu0.20.04.10+tuxcare.els14_arm64.deb
sha:e94143652e62b75d28b1887196fc26a176d34540
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
