CVE-2024-34459

Publication date 14 May 2024

Last updated 29 January 2025

Ubuntu priority

Low

Why this priority?

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

Read the notes from the security team

Why is this CVE low priority?

just a crash in a command line tool

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
libxml2 24.10 oracular
Not affected
24.04 LTS noble
Fixed 2.9.14+dfsg-1.3ubuntu3.1
23.10 mantic Ignored end of life, was needs-triage
22.04 LTS jammy
Fixed 2.9.13+dfsg-1ubuntu0.5
20.04 LTS focal
Fixed 2.9.10+dfsg-5ubuntu0.20.04.8
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty Ignored end of ESM support, was needs-triage

Notes

mdeslaur

this is just a crash via OOB read in a the command-line xmllint tool, there is very little security impact here

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libxml2