CVE-2025-7425

描述

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

如何修補 CVE-2025-7425

要修補 CVE-2025-7425,請將受影響套件升級到下列已修補版本。

• —升級至 1.8.0 或更新版本
• —升級至 1.8.0 或更新版本
• —升級至 1.8.0 或更新版本
• —升級至 2.9.14+dfsg-1.3~deb12u4 或更新版本
• —未列出修補版本

CVE-2025-7425 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• from 0, < 1.8.0, >= 1.9.0, < 8.0.481
• from 0, < 1.8.0, >= 1.9.0, < 8.0.481
• from 0, < 1.8.0, >= 1.9.0, < 8.0.481
• from 0, < 2.9.14+dfsg-1.3~deb12u4
• from 0

CVSS 分數

參考連結(45)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-7425
• WEBseclists.org/fulldisclosure/2025/Aug/0
• WEBseclists.org/fulldisclosure/2025/Jul/30
• WEBseclists.org/fulldisclosure/2025/Jul/32
• WEB