Publish Advisories

GHSA-vcc3-rw6f-jv97 GHSA-3hp8-6j24-m5gm
2026-05-22 18:04:22 -07:00 · 2025-05-23 20:03:49 +00:00
parent 9ee4900c1d
commit 1945091876
2 changed files with 8 additions and 6 deletions
@@ -1,11 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vcc3-rw6f-jv97",
-  "modified": "2024-03-18T20:38:40Z",
+  "modified": "2025-05-23T20:02:12Z",
  "published": "2024-03-18T20:38:40Z",
+  "withdrawn": "2025-05-23T20:02:12Z",
  "aliases": [],
-  "summary": "Use-after-free in libxml2 via Nokogiri::XML::Reader",
-  "details": "### Summary\n\nNokogiri upgrades its dependency libxml2 as follows:\n- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6\n- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4\n\nlibxml2 v2.11.7 and v2.12.5 address the following vulnerability:\n\nCVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri, and only if\nthe packaged libraries are being used. If you've overridden defaults at installation time to use\nsystem libraries instead of packaged libraries, you should instead pay attention to your distro's\nlibxml2 release announcements.\n\nJRuby users are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as **Moderate**.\n\n### Impact\n\nFrom the CVE description, this issue applies to the `xmlTextReader` module (which underlies\n`Nokogiri::XML::Reader`):\n\n> When using the XML Reader interface with DTD validation and XInclude expansion enabled,\n> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\n### Mitigation\n\nUpgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile\nand link Nokogiri against patched external libxml2 libraries which will also address these same\nissues.\n",
+  "summary": "Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader",
+  "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xc9x-jj77-9p9j. This link is maintained to preserve external references.\n\n# Original Description\n\n### Summary\n\nNokogiri upgrades its dependency libxml2 as follows:\n- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6\n- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4\n\nlibxml2 v2.11.7 and v2.12.5 address the following vulnerability:\n\nCVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri, and only if\nthe packaged libraries are being used. If you've overridden defaults at installation time to use\nsystem libraries instead of packaged libraries, you should instead pay attention to your distro's\nlibxml2 release announcements.\n\nJRuby users are not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as **Moderate**.\n\n### Impact\n\nFrom the CVE description, this issue applies to the `xmlTextReader` module (which underlies\n`Nokogiri::XML::Reader`):\n\n> When using the XML Reader interface with DTD validation and XInclude expansion enabled,\n> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\n### Mitigation\n\nUpgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile\nand link Nokogiri against patched external libxml2 libraries which will also address these same\nissues.",
  "severity": [],
  "affected": [
    {