BSD Portslibxslt -- multiple vulnerabilities
· CVE-2024-55549, CVE-2025-24855 · VuXML entry
[CVE-2024-55549] Fix UAF related to excluded namespaces xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. [CVE-2025-24855] Fix use-after-free of XPath context node numbers.c in libxslt before 1.1.43 has a use-after-free because , in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to …
Affected versions
- libxslt < 1.1.43
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | textproc/libxslt | 1.1.43 | fixed | |
| OpenBSD | textproc/libxslt | 1.1.45 | out of range, by version | |
| NetBSD | textproc/libxslt | 1.1.45 | not listed | |
| MidnightBSD | textproc/libxslt | 1.1.45 | out of range, by version | |
| FreeBSD | textproc/libxslt | 1.1.45 | fixed |