CVE-2025-24855
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
- T
Tim Bastin detected CVE-2025-24855 with a risk of 1.87
System updated the risk assessment from 1.87 to 1.25
System recalculated raw risk assessment
System updated the risk assessment from 1.25 to 3.75
System recalculated raw risk assessment
- T
Tim Bastin detected CVE-2025-24855 with a risk of 3.75
System detected CVE-2025-24855 with a risk of 3.75
- T
Tim Bastin detected CVE-2025-24855 with a risk of 3.75
System fixed CVE-2025-24855
System fixed CVE-2025-24855
System fixed CVE-2025-24855
System fixed CVE-2025-24855
System detected CVE-2025-24855 with a risk of 3.75
Add a comment
Affected component
debian/libxslt