UbuntuUpdates.org

Package "python3-libxml2"

Name: python3-libxml2

Description:

GNOME XML library - Python3 bindings
Latest version: 2.15.2+dfsg-0.1ubuntu0.3
Release: resolute (26.04)
Level: updates
Repository: universe
Head package: libxml2
Homepage: http://xmlsoft.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python3-libxml2"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "python3-libxml2" in Resolute

Repository Area Version
base universe 2.15.2+dfsg-0.1
security universe 2.15.2+dfsg-0.1ubuntu0.3

Changelog

Version: 2.15.2+dfsg-0.1ubuntu0.3 2026-10-09 00:07:59 UTC

libxml2 (2.15.2+dfsg-0.1ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference when parsing XML catalogs
    - debian/patches/CVE-2026-76781.patch: Skip the duplicate nextCatalog
      check when the catalog attribute is missing in catalog.c.
    - CVE-2026-76781
  * SECURITY UPDATE: integer overflow leading to heap-based buffer overflow
    in xmlDictAddQString
    - debian/patches/CVE-2026-86138.patch: Add overflow checks to the pool
      size calculations in xmlDictAddQString in dict.c.
    - CVE-2026-86138
  * SECURITY UPDATE: integer overflow in xmlURIEscapeStr
    - debian/patches/CVE-2026-86139.patch: Return NULL for strings longer
      than INT_MAX in xmlURIEscapeStr in uri.c.
    - CVE-2026-86139
  * SECURITY UPDATE: heap-based buffer overflow in XPointer evaluation
    - debian/patches/CVE-2026-86142.patch: Return an error when xmlStrlen
      reports an overflowed expression in xmlXPtrEvalXPtrPart in xpointer.c.
    - CVE-2026-86142
  * SECURITY UPDATE: integer overflow in length passed to output callbacks
    - debian/patches/CVE-2026-86143.patch: Fail when the output buffer holds
      >= INT_MAX bytes in xmlIO.c.
    - CVE-2026-86143
  * SECURITY UPDATE: XInclude processing ignores parse flags
    - debian/patches/CVE-2026-86144.patch: Pass the document parseFlags to
      xmlXIncludeProcess and xmlXIncludeProcessTree and apply parse flags
      to text includes in xinclude.c.
    - CVE-2026-86144

 -- Charles Cochran Tue, 06 Oct 2026 12:41:04 -0400
Source diff to previous version
CVE-2026-76781 A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML
CVE-2026-86138 In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-86139 In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-86142 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-86143 In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a l
CVE-2026-86144 In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for

Version: 2.15.2+dfsg-0.1ubuntu0.2 2026-09-21 19:08:00 UTC

libxml2 (2.15.2+dfsg-0.1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: stack-based buffer overflow in xmlSnprintfElements
    - debian/patches/CVE-2026-86140.patch: fix: add bounds checks to
      xmlSnprintfElements in valid.c in valid.c.
    - CVE-2026-86140
  * SECURITY UPDATE: double free in Python SAX attributeDecl callback
    - debian/patches/CVE-2026-74860.patch: python: Do not decref string after
      adding to the list in python/libxml.c.
    - CVE-2026-74860

 -- John Breton Thu, 17 Sep 2026 08:09:57 -0400
Source diff to previous version
CVE-2026-86140 In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-74860 A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML doc

Version: 2.15.2+dfsg-0.1ubuntu0.1 2026-06-22 21:07:35 UTC

  libxml2 (2.15.2+dfsg-0.1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of service in parser.
    - debian/patches/CVE-2026-6732.patch: Pass userData instead of ctxt in
      parser.c
    - CVE-2026-6732

 -- Kyle Kernick <email address hidden> Fri, 19 Jun 2026 11:43:10 -0600
CVE-2026-6732 A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document


About   -   Send Feedback to @ubuntu_updates