BSD Portslibxslt -- multiple vulnerabilities
· CVE-2025-7424, CVE-2025-7425, CVE-2025-9714, CVE-2025-11731 · VuXML entry
Alan Coopersmith reports: On 6/16/25 15:12, Alan Coopersmith wrote: BTW, users of libxml2 may also be using its sibling project, libxslt, which currently has no active maintainer, but has three unfixed security issues reported against it according to https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt 2 of the 3 have now been disclosed: (CVE-2025-7424) libxslt: Type confusion in …
Affected versions
- libxslt < 1.1.44
- linux-c7-libxslt < 2
- linux-rl9-libxslt < 2
By system
4 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | textproc/libxslt | 1.1.43 | vulnerable since 2025-07-12 | |
| OpenBSD | textproc/libxslt | 1.1.45 | out of range, by version | |
| NetBSD | textproc/libxslt | 1.1.45 | listed since 2025-07-12 | |
| MidnightBSD | textproc/libxslt | 1.1.45 | out of range, by version | |
| FreeBSD | textproc/libxslt | 1.1.45 | fixed | |
| FreeBSD | textproc/linux-c7-libxslt | 1.1.28_1 | vulnerable since 2025-07-12 | |
| MidnightBSD | textproc/linux-c7-libxslt | 1.1.28_1 | in range, by version | |
| FreeBSD | textproc/linux-rl9-libxslt | 1.1.34_4 | vulnerable since 2025-07-12 | |
| MidnightBSD | textproc/linux-rl9-libxslt | 1.1.34_3 | in range, by version |