Use-After-Free in libxslt numbers.c
CVE: CVE-2025-24855
Component: libxslt
CWE: CWE-416
Severity: Important
CVSS v3: 7.8/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Release date: 2025-03-14T00:00:00+00:00

A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored.

Statement: The use-after-free vulnerability in libxslt marked as a high severity rather than moderate due to its potential impact on system integrity and availability. This flaw arises during nested XPath evaluations where the context node can be modified without proper restoration, leading to use-after-free conditions. Exploitation of this vulnerability allows an attacker to execute arbitrary code, potentially causing significant disruptions or unauthorized actions within the affected system.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

     https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:753e18b761de2e56bdf29b56665c33624f1c27d7cfa0b6b5c081bcc3b035c864

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
     https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:2f46021d7977a7211e043834bda0a0fd728e04cdc7c7b657aa1f51ee7a1fbf34

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:66bd4e160209b4e7add5514498c4889812b76fa2786d1219d7d2152eea1b4f1c

(For s390x architecture)
The image digest is sha256:9a56729c25596d90c228f04d5e4b5080a3921a325e0c768da51b81b6a032cf07

(For ppc64le architecture)
The image digest is sha256:078d5b2c3ce7ed409c454c01113e6171a8852f434069c1f8565e4a310b8e00b5

(For aarch64 architecture)
The image digest is sha256:b1e60833e9535efa25a4e42efe461e6c0c9b7fcea4a499428bdee7577884f0cf

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f0421eafd1ab27c694f6bfc6ec8a8641636030485a3a4c80071ce7fa1a1bf04c

      (For s390x architecture)
      The image digest is sha256:49188f681f854dda12f1c3e72b5066d957f5903705ca6d060bb54399838272e3

      (For ppc64le architecture)
      The image digest is sha256:4e464e5377d636c2f14838b0965af486949b410a31be742b7ca2e5116954d304

      (For aarch64 architecture)
      The image digest is sha256:06f68ebf40881e9c7e29b94883a840e1119ed104e33676d2c15f5ad066339306

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9871f990d9f956d735e85e2040101377d5fd7cc4e62e8f54feb62650190216c9

      (For s390x architecture)
      The image digest is sha256:851bac58b8ba11752792467aca680d41a1b306ba9e4973dca4b79d4adba93e55

      (For ppc64le architecture)
      The image digest is sha256:cbd719c4e8627d894621ffbfca8adc31669ccfd63411889b58810111bcf34b00

      (For aarch64 architecture)
      The image digest is sha256:9cd61312dbd5619bed52ea20afb0fb6b6634f4c76394fea5b5187fc4083e8027

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16]/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:035baf97e4c715fc1afb681a9f789d99ebaf568b2656584d59f72962e0d14bcd

      (For s390x architecture)
      The image digest is sha256:ae63030ebb847f17ac0d2273f55d5db43df6b9f324197573bd9d2fbb7403036a

      (For ppc64le architecture)
      The image digest is sha256:c693db40e8d19847cd4bce1541344cc93d828221c029dc7ddeee4c829a351a12

      (For aarch64 architecture)
      The image digest is sha256:61a46e56e230e5869af207484585a5e61141e322d539616422ec7e61bc4ad137

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:31e8978d1f7a24c3e70dcc12c93dd5e73311b78e528f73beb020ddbe3270e07d

      (For s390x architecture)
      The image digest is sha256:7e6a77a66b2f93afb2108ada0617d26dceadb130b58a5d3070142a7f6aca4ade

      (For ppc64le architecture)
      The image digest is sha256:af37b07cf408da430bab837ba8a0083934fa99df14efd7855240b77d9e102f0e

      (For aarch64 architecture)
      The image digest is sha256:e5d7b0851e8cd4378bc810b2fd1f19489836ea186a6678eed1add4bed4f08b13

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.