VIR Vulnerability Intelligence Relay

CVE-2025-6021

high
Published 2025-07-09 · Modified 2025-07-09
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.5

Description

RHSA-2025:10698: libxml2 security update (Important)

Predictions

Exploit likelihood
83%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
redhat Red Hat Mixed 15 releases
VersionStatusFixed in
10.0_aarch64 Affected —
10.0 Affected —
9.6 Affected —
9.4_aarch64 Affected —
9.4 Affected —
9.0_aarch64 Affected —
9.0 Affected —
9 Fixed —
8.8 Affected —
8.6 Affected —
8.4 Affected —
8.0_aarch64 Affected —
8.0 Affected —
8 Fixed —
7.0 Affected —
arch Arch Fixed 1 release
VersionStatusFixed in
— Fixed 2.14.4-1
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 2.12.7+dfsg+really2.9.14-2
sid Fixed 2.12.7+dfsg+really2.9.14-2
forky Fixed 2.12.7+dfsg+really2.9.14-2
bullseye Fixed 2.9.10+dfsg-6.7+deb11u8
bookworm Fixed 2.9.14+dfsg-1.3~deb12u3
rockylinux Rocky Linux Fixed 2 releases
VersionStatusFixed in
9 Fixed —
8 Fixed —

Application impact
VendorProductVersionsFixed
xmlsoftlibxml2{"endExcluding":"2.14.4"}2.14.4
redhat redhatjboss_core_services-
redhat redhatopenshift_container_platform4.12
redhat redhatopenshift_container_platform4.13
redhat redhatopenshift_container_platform4.14
redhat redhatopenshift_container_platform4.15
redhat redhatopenshift_container_platform4.16
redhat redhatopenshift_container_platform4.17
redhat redhatopenshift_container_platform4.18
redhat redhatopenshift_container_platform_for_arm644.13
redhat redhatopenshift_container_platform_for_arm644.14
redhat redhatopenshift_container_platform_for_arm644.15
redhat redhatopenshift_container_platform_for_arm644.16
redhat redhatopenshift_container_platform_for_arm644.17
redhat redhatopenshift_container_platform_for_arm644.18
redhat redhatopenshift_container_platform_for_ibm_z4.13
redhat redhatopenshift_container_platform_for_ibm_z4.14
redhat redhatopenshift_container_platform_for_ibm_z4.15
redhat redhatopenshift_container_platform_for_ibm_z4.16
redhat redhatopenshift_container_platform_for_ibm_z4.17
redhat redhatopenshift_container_platform_for_ibm_z4.18
redhat redhatopenshift_container_platform_for_linuxone4.13
redhat redhatopenshift_container_platform_for_linuxone4.14
redhat redhatopenshift_container_platform_for_linuxone4.15
redhat redhatopenshift_container_platform_for_linuxone4.16
redhat redhatopenshift_container_platform_for_linuxone4.17
redhat redhatopenshift_container_platform_for_linuxone4.18
redhat redhatopenshift_container_platform_for_power4.13
redhat redhatopenshift_container_platform_for_power4.14
redhat redhatopenshift_container_platform_for_power4.15
redhat redhatopenshift_container_platform_for_power4.16
redhat redhatopenshift_container_platform_for_power4.17
redhat redhatopenshift_container_platform_for_power4.18

References

CWEs

CWE-787

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.