diff --git a/advisories/github-reviewed/2025/02/GHSA-5mwf-688x-mr7x/GHSA-5mwf-688x-mr7x.json b/advisories/github-reviewed/2025/02/GHSA-5mwf-688x-mr7x/GHSA-5mwf-688x-mr7x.json index 2225a3de124..c216c2598d5 100644 --- a/advisories/github-reviewed/2025/02/GHSA-5mwf-688x-mr7x/GHSA-5mwf-688x-mr7x.json +++ b/advisories/github-reviewed/2025/02/GHSA-5mwf-688x-mr7x/GHSA-5mwf-688x-mr7x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5mwf-688x-mr7x", - "modified": "2025-02-19T22:17:19Z", + "modified": "2025-03-10T22:39:14Z", "published": "2025-02-19T22:17:19Z", + "withdrawn": "2025-03-10T22:39:14Z", "aliases": [], - "summary": "Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171", - "details": "## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", + "summary": "Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171", + "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.\n\n# Original Description\n\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", "severity": [], "affected": [ {