ALAS2-2025-2823


Amazon Linux 2 Security Advisory: ALAS2-2025-2823
Advisory Released Date: 2025-04-16
Advisory Updated Date: 2025-04-16
Severity: Important

Issue Overview:

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. (CVE-2024-55549)

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)


Affected Packages:

libxslt


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update libxslt to update your system.

New Packages:
aarch64:
    libxslt-1.1.28-6.amzn2.0.3.aarch64
    libxslt-devel-1.1.28-6.amzn2.0.3.aarch64
    libxslt-python-1.1.28-6.amzn2.0.3.aarch64
    libxslt-debuginfo-1.1.28-6.amzn2.0.3.aarch64

i686:
    libxslt-1.1.28-6.amzn2.0.3.i686
    libxslt-devel-1.1.28-6.amzn2.0.3.i686
    libxslt-python-1.1.28-6.amzn2.0.3.i686
    libxslt-debuginfo-1.1.28-6.amzn2.0.3.i686

src:
    libxslt-1.1.28-6.amzn2.0.3.src

x86_64:
    libxslt-1.1.28-6.amzn2.0.3.x86_64
    libxslt-devel-1.1.28-6.amzn2.0.3.x86_64
    libxslt-python-1.1.28-6.amzn2.0.3.x86_64
    libxslt-debuginfo-1.1.28-6.amzn2.0.3.x86_64