Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
CVE: CVE-2025-6021
Component: libxml2
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-12T00:00:00+00:00

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Statement: This vulnerability is rated Moderate due to the lack of confidentiality impact and limited integrity concerns, with the main risk being potential denial-of-service  from a crash. Exploitation requires crafted XML input and specific application behavior using xmlBuildQName. While it’s a write overflow, modern mitigations make remote code execution unlikely.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous erratamupdate:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:7c5f757b5d3d2048052401dd057f3096890b4075ca9b86b5f890a8e4c6d38b85

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:32f55a5ff24713e240a293ced4f8cb202bbdf482095593e226d1ea4397fefe8e

All OpenShift Container Platform 4.13 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:25904f8f9b41f2a613671ba35ec15a8a2f19ba4f084026428dacb0cbd9f4088e

      (For s390x architecture)
      The image digest is sha256:de4165b400fabdb7854667c69374c834535195c8575eefb4c0df6f45b8ad4749

      (For ppc64le architecture)
      The image digest is sha256:0f40172e2e7ae0e42365157610cc358e9246de1ff04a150065a745ec1321116a

      (For aarch64 architecture)
      The image digest is sha256:77e7cc6005486fd67f7e3a8bb4ff5c5890ed4fa32ba373d8997a86c051601772

All OpenShift Container Platform 4.14 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:dfeabcb6b9d567eaa9c6a32f0e20cc547e0fa2e972963e5cef6e9c15838328f9

      (For s390x architecture)
      The image digest is sha256:0a007b78ea7e6e6a4625c34e7783687a04935462d9b41eafe8663613b31eb753

      (For ppc64le architecture)
      The image digest is sha256:b77a48cdf0b9d89eba520588ffcd99268e3edeb56627e17395b223ca3faf8da1

      (For aarch64 architecture)
      The image digest is sha256:5eb9c8cac53b255dfe62cea367ff461ecf8aff32aa858df39d898e7ad60d06ab

All OpenShift Container Platform 4.15 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:21b7cb796336c9c8f5d425af265ce9b2ec043eef0a9cfdc055f04e57d68cc9ca

      (For s390x architecture)
      The image digest is sha256:f14964f5029c3db1c0e5c5aedad1cae6f73560db1d19e9afee24c4802d3d2a09

      (For ppc64le architecture)
      The image digest is sha256:77a88c32b6d4e0ad0b3c51b54068f7ba91bb4a41967f6aea8f641c7ad3f536df

      (For aarch64 architecture)
      The image digest is sha256:60c0e2c9810fa6f91e7bcc1bbebefe6195799861ced8fa98882d06168daa3f2b

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:fea49ae633643615f8707ecbe801b484181b87db0746d2d85592768dbddf43c9

      (For s390x architecture)
      The image digest is sha256:d3e9032b799e87cc82121c9da006d375845134120205fa2aa2edca033abf97d3

      (For ppc64le architecture)
      The image digest is sha256:6c6251666a8e89289819cdb9dd7269d1ab2d90fdcb96c2b15b2e04908d15fd88

      (For aarch64 architecture)
      The image digest is sha256:3b83546dc680f6e3975faf101471c4e29fdc76f406327665e22f63ff406246c0

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:16078b671c7f5490a2136f2cd9a694d48bb38af1280ef9e2ae9ce28af075cca5

      (For s390x architecture)
      The image digest is sha256:0acecac6ce56112ac0feadc5472a77103f98df529ebb41f7b1e2adb97b6180b5

      (For ppc64le architecture)
      The image digest is sha256:c07839bb178536cb5459bac0178d279f68e905fe8efd0196ecf173d6023f8016

      (For aarch64 architecture)
      The image digest is sha256:8801bfcbdd29d4abd85912a239210ae8d6a79d90e3487fc47bcaaaefc93abf27

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:02ec914b5380b9e4e048b830c9521e8d11f7f613d4ff3977147107770288a595

      (For s390x architecture)
      The image digest is sha256:8538bd4e929e31d9ac9f316ca0417790e1000ac295f362fc759742081e931371

      (For ppc64le architecture)
      The image digest is sha256:0c875d09abdff5ea1955864ea1c39ff847a03f48746bbf053242e2d35c0eef28

      (For aarch64 architecture)
      The image digest is sha256:217591be3f6519392ea15a7e85670261fa1132f304204265edb3825191e80974

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat Insights proxy product RPM.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are strongly advised to apply vendor-supplied patches as soon as they become available to address the underlying integer overflow flaw in the affected code.