oracle-20256597

{
  "cves": [
    "CVE-2024-40896"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "CRITICAL"
  },
  "description": "[2.12.5-5]\n- Fix CVE-2024-56171 (RHEL-80119)\n- Fix CVE-2025-24928 (RHEL-80134)\n\n[2.12.5-4]\n- Fix CVE-2024-40896 (RHEL-72060)\n\n[2.12.5-3]\n- Bump release for October 2024 mass rebuild:\n  Resolves: RHEL-64018\n\n[2.12.5-2]\n- Bump release for June 2024 mass rebuild\n\n[2.12.5-1]\n- Update to 2.12.5 (#2262648)\n\n[2.12.4-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild\n\n[2.12.4-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild\n\n[2.12.4-1]\n- Update to 2.12.4 (#2258493)\n\n[2.12.3-1]\n- Update to 2.12.3 (#2254194)\n\n[2.12.2-2]\n- Upstream patch to add extra includes\n\n[2.12.2-1]\n- Update to 2.12.2 (#2137281)\n- Enable W3C XML Conformance and Schema test suites\n\n[2.12.1-1]\n- Update to 2.12.1 (#2250062)\n\n[2.12.0-1]\n- Update to 2.12.0 (#2250062)\n\n[2.11.6-1]\n- Update to 2.11.6\n\n[2.11.5-1]\n- Update to 2.11.5 (#2190441)\n\n[2.10.4-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild\n\n[2.10.4-2]\n- Rebuilt for Python 3.12\n\n[2.10.4-1]\n- Update to 2.10.4 (#2185870)\n\n[2.10.3-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild\n\n[2.10.3-2]\n- Set build options to maintain (most) symbols from 2.9.14 (#2139546)\n\n[2.10.3-1]\n- Update to 2.10.3 (#2119077)\n\n[2.10.2-1]\n- Update to 2.10.2 (#2119077)\n\n[2.9.14-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild\n\n[2.9.14-2]\n- Rebuilt for Python 3.11\n\n[2.9.14-1]\n- Update to 2.9.14 (#2080961)\n\n[2.9.13-1]\n- Update to 2.9.13\n\n[2.9.12-7]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild\n\n[2.9.12-6]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild\n\n[2.9.12-5]\n- Rebuilt for Python 3.10\n\n[2.9.12-4]\n- Fix xmlNodeDumpOutputInternal regression (#1965662)\n\n[2.9.12-3]\n- Fix multiarch conflict in devel subpackage\n\n[2.9.12-2]\n- Fix python-lxml regression with 2.9.12\n\n[2.9.12-1]\n- Update to 2.9.12 (#1960153)\n\n[2.9.10-12]\n- Fix CVE-2021-3537 (#1956524)\n\n[2.9.10-11]\n- Fix CVE-2021-3516 (#1954227)\n- Fix CVE-2021-3517 (#1954234)\n- Fix CVE-2021-3518 (#1954243)\n\n[2.9.10-10]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild\n\n[2.9.10-9]\n- Build the Python extension with the PY_SSIZE_T_CLEAN macro to make it\n  compatible with Python 3.10.\n- Fixes: rhbz#1890878.\n\n[2.9.10-8]\n- Add correct fix for CVE-2020-24977 (RHBZ#1877788), thanks: Jan de Groot.\n\n[2.9.10-7]\n- Add fix for CVE-2020-24977 (RHBZ#1877788).\n\n[2.9.10-6]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild\n\n[2.9.10-5]\n- Rebuilt for Python 3.9\n\n[2.9.10-4]\n- Fix CVE-2019-20388 (#1799736)\n- Fix CVE-2020-7595 (#1799786)\n\n[2.9.10-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild\n\n[2.9.10-2]\n- Fix relaxed approach to nested documents on object disposal (#1780573)\n\n[2.9.10-1]\n- Update to 2.9.10 (#1767151)\n\n[2.9.9-7]\n- Subpackage python2-libxml2 has been removed\n  See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal\n\n[2.9.9-6]\n- Rebuilt for Python 3.8.0rc1 (#1748018)\n\n[2.9.9-5]\n- Rebuild to fix corrupted libxml2-static package on aarch64 (#1745020)\n\n[2.9.9-4]\n- Rebuilt for Python 3.8\n\n[2.9.9-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild\n\n[2.9.9-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild\n\n[2.9.9-1]\n- Update to 2.9.9\n\n[2.9.8-5]\n- Add patch to fix crash: xmlParserPrintFileContextInternal mangles utf8\n\n[2.9.8-4]\n- Backport patches from upstream\n\n[2.9.8-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild\n\n[2.9.8-2]\n- Rebuilt for Python 3.7\n\n[2.9.8-1]\n- Update to 2.9.8\n\n[2.9.7-4]\n- Rebuild with new LDFLAGS from redhat-rpm-config\n\n[2.9.7-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild\n\n[2.9.7-2]\n- Switch to %ldconfig_scriptlets\n\n[2.9.7-1]\n- Update to 2.9.7\n- Cleanups in packaging\n\n[2.9.5-3]\n- Update Python 2 dependency declarations to new packaging standards\n  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)\n\n[2.9.5-2]\n- Fix reporting error about undefined XPath variables (bug #1493613)\n\n[2.9.5-1]\n- update to 2.9.5\n\n[2.9.4-5]\n- Python 2 binary package renamed to python2-libxml2\n  See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3\n\n[2.9.4-4]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild\n\n[2.9.4-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild\n\n[2.9.4-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild\n\n[2.9.4-1]\n- Update to 2.9.4.\n- Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.\n\n[2.9.3-5]\n- Rebuild for Python 3.6\n\n[2.9.3-4]\n- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages\n\n[2.9.3-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild\n\n[2.9.3-2]\n- Fix obsoletes versions now that F22 has libxml2 2.9.3 (#1287262)\n\n[2.9.2-1]\n- upstream release of 2.9.3\n- Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819\n  CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500\n  and CVE-2015-8242\n- many other bug fixes\n\n[2.9.2-9]\n- Rebuilt for Python3.5 rebuild\n- Python3.5 has new naming convention for byte compiled files\n\n[2.9.2-8]\n- Remove executable permissions from documentation.  Complies with packaging\n  guidelines and solves issue of libxml2-python3 package depending on python2\n\n[2.9.2-7]\n- Remove dependency on python2 from python3 subpackage, rhbz#1250940\n\n[2.9.2-6]\n- Rename the Python 3 subpackage to python3-libxml2 as per guidelines\n\n[2.9.2-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild\n\n[2.9.2-4]\n- Rebuilt for Fedora 23 Change\n  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code\n\n[2.9.2-3]\n- Added Python 3 subpackage\n\n[2.9.2-2]\n- Avoid corrupting the xml catalogs\n\n[2.9.2-1]\n- upstream release of 2.9.2\n- Fix for CVE-214-3660 billion laugh DOS\n- many other bug fixes\n\n[2.9.1-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild\n\n[2.9.1-4]\n- fix license handling\n\n[2.9.1-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild\n\n[2.9.1-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild\n\n[2.9.1-1]\n- upstream release of 2.9.1\n- a couple more API entry point\n- compatibility with python3\n- a lot of bug fixes\n\n[2.9.0-4]\n- fix --nocheck build which I broke in october rhbz#909767\n\n[2.9.0-3]\n- workaround for crc/len check failure, rhbz#877567\n\n[2.9.0-2]\n- remaining cleanups from merge bug rhbz#226079\n- do not put the docs in the main package, only in -devel rhbz#864731\n\n[2.9.0-1]\n- upstream release of 2.9.0\n- A few new API entry points\n- More resilient push parser mode\n- A lot of portability improvement\n- Faster XPath evaluation\n- a lot of bug fixes and smaller improvement\n\n[2.9.0-0rc1]\n- upstream release candidate 1 of 2.9.0\n- introduce a small API change, but ABI compatible, see\n  https://mail.gnome.org/archives/xml/2012-August/msg00005.html\n  patches for php, gcc/libjava and evolution-data-connector are upstream\n  Grab me in cases of problems veillard@redhat.com\n- many bug fixes including security aspects and small improvements\n\n[2.8.0-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild\n\n[2.8.0-1]\n- upstream release of 2.8.0\n- add lzma compression support\n- many bug fixes and small improvements\n\n[2.7.8-7]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild\n\n[2.7.8-6]\n- fix a double free in XPath CVE-2010-4494 bug 665965\n\n[2.7.8-5]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild\n\n[2.7.8-4]\n- reactivate shared libs versionning script\n\n[2.7.8-1]\n- Upstream release of 2.7.8\n- various bug fixes, including potential crashes\n- new non-destructive formatting option\n- date parsing updated to RFC 5646\n\n[2.7.7-2]\n- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild\n\n[2.7.7-1]\n- Upstream release of 2.7.7\n- fix serious trouble with zlib = 1.2.4\n- xmllint new option --xpath\n- various HTML parser improvements\n- includes a number of nug fixes\n\n[2.7.6-1]\n- Upstream release of 2.7.6\n- restore thread support off by default in 2.7.5\n\n[2.7.5-1]\n- Upstream release of 2.7.5\n- fix a couple of Relax-NG validation problems\n- couple more fixes\n\n[2.7.4-2]\n- fix a problem with little data at startup affecting inkscape #523002\n\n[2.7.4-1]\n- upstream release 2.7.4\n- symbol versioning of libxml2 shared libs\n- very large number of bug fixes\n\n[2.7.3-4]\n- two patches for parsing problems CVE-2009-2414 and CVE-2009-2416\n\n[2.7.3-3]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n[2.7.3-2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild\n\n[2.7.3-1]\n- new release 2.7.3\n- limit default max size of text nodes\n- special parser mode for PHP\n- bug fixes and more compiler checks\n\n[2.7.2-7]\n- Pull back into Python 2.6\n\n[2.7.2-6]\n- AutoProvides requires BuildRequires pkgconfig\n\n[2.7.2-5]\n- rebuild to get provides(libxml-2.0) into HEAD rawhide\n\n[2.7.2-4]\n- Rebuild for pkgconfig logic\n\n[2.7.2-3]\n- Rebuild for Python 2.6\n\n[2.7.2-2.fc11]\n- two patches for size overflows problems CVE-2008-4225 and CVE-2008-4226\n\n[2.7.2-1.fc10]\n- new release 2.7.2\n- Fixes the known problems in 2.7.1\n- increase the set of options when saving documents\n\n[2.7.1-2.fc10]\n- fix a nasty bug in 2.7.x, http://bugzilla.gnome.org/show_bug.cgi?id=554660\n\n[2.7.1-1.fc10]\n- fix python serialization which was broken in 2.7.0\n- Resolve: rhbz#460774\n\n[2.7.0-1.fc10]\n- upstream release of 2.7.0\n- switch to XML 1.0 5th edition\n- switch to RFC 3986 for URI parsing\n- better entity handling\n- option to remove hardcoded limitations in the parser\n- more testing\n- a new API to allocate entity nodes\n- and lot of fixes and clanups\n\n[2.6.32-4.fc10]\n- fix for entities recursion problem\n- Resolve: rhbz#459714\n\n[2.6.32-3.fc10]\n- cleanup based on Fedora packaging guidelines, should fix #226079\n- separate a -static package\n\n[2.6.32-2.fc10]\n- try to fix multiarch problems like #440206\n\n[2.6.32-1.fc9]\n- upstream release 2.6.32 see http://xmlsoft.org/news.html\n- many bug fixed upstream\n\n[2.6.31-2]\n- Autorebuild for GCC 4.3\n\n[2.6.31-1.fc9]\n- upstream release 2.6.31 see http://xmlsoft.org/news.html\n- many bug fixed upstream\n\n[2.6.30-1]\n- upstream release 2.6.30 see http://xmlsoft.org/news.html\n- many bug fixed upstream\n\n[2.6.29-1]\n- upstream release 2.6.29 see http://xmlsoft.org/news.html\n- many bug fixed upstream\n\n[2.6.28-2]\n- Bump revision to fix N-V-R problem\n\n[2.6.28-1]\n- upstream release 2.6.28 see http://xmlsoft.org/news.html\n- many bug fixed upstream\n\n[2.6.27-2]\n- rebuild against python 2.5\n\n[2.6.27-1]\n- upstream release 2.6.27 see http://xmlsoft.org/news.html\n- very large amount of bug fixes reported upstream\n\n[2.6.26-2.1.1]\n- rebuild\n\n[2.6.26-2.1]\n- rebuild\n\n[2.6.26-2]\n- fix bug #192873\n\n[2.6.26-1]\n- upstream release 2.6.26 see http://xmlsoft.org/news.html\n\n* Tue Jun 06 2006 Daniel Veillard veillard@redhat.com\n- upstream release 2.6.25 broken, do not ship !",
  "id": "ORACLE-20256597",
  "ovalId": "oval:com.oracle.elba:def:20256597",
  "source": "oracle_linux",
  "title": "ELBA-2025-6597: libxml2 bug fix and enhancement update (CRITICAL)",
  "url": "https://linux.oracle.com/security/oval/com.oracle.elsa-all.xml.bz2"
}