GHSA-vcc3-rw6f-jv97: Use-after-free in libxml2 via Nokogiri::XML::Reader

Nokogiri upgrades its dependency libxml2 as follows:

  • v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
  • v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if the packaged libraries are being used. If you’ve overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro’s libxml2 release announcements.

JRuby users are not affected.

References

Code Behaviors & Features

Detect and mitigate GHSA-vcc3-rw6f-jv97 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →