Skip to content

Commit 0340343

Browse files
jasnowpostmodern
jasnow
authored and
postmodern
committed
GHSA SYNC: 2 brand new advisories
1 parent bba9e84 commit 0340343

File tree

2 files changed

+127
-0
lines changed

2 files changed

+127
-0
lines changed

‎gems/nokogiri/GHSA-353f-x4gh-cqq8.yml

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
gem: nokogiri
3+
ghsa: 353f-x4gh-cqq8
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
5+
title: Nokogiri patches vendored libxml2 to resolve multiple CVEs
6+
date: 2025-07-21
7+
description: |
8+
## Summary
9+
10+
Nokogiri v1.18.9 patches the vendored libxml2 to address
11+
CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,
12+
and CVE-2025-49796.
13+
14+
## Impact and severity
15+
16+
### CVE-2025-6021
17+
18+
A flaw was found in libxml2's xmlBuildQName function, where integer
19+
overflows in buffer size calculations can lead to a stack-based
20+
buffer overflow. This issue can result in memory corruption or a
21+
denial of service when processing crafted input.
22+
23+
NVD claims a severity of 7.5 High
24+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
25+
26+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae
27+
28+
### CVE-2025-6170
29+
30+
A flaw was found in the interactive shell of the xmllint command-line
31+
tool, used for parsing XML files. When a user inputs an overly long
32+
command, the program does not check the input size properly, which
33+
can cause it to crash. This issue might allow attackers to run
34+
harmful code in rare configurations without modern protections.
35+
36+
NVD claims a severity of 2.5 Low
37+
(CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
38+
39+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1
40+
41+
### CVE-2025-49794
42+
43+
A use-after-free vulnerability was found in libxml2. This issue
44+
occurs when parsing XPath elements under certain circumstances when
45+
the XML schematron has the <sch:name path="..."/> schema elements.
46+
This flaw allows a malicious actor to craft a malicious XML document
47+
used as input for libxml, resulting in the program's crash using
48+
libxml or other possible undefined behaviors.
49+
50+
NVD claims a severity of 9.1 Critical
51+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
52+
53+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
54+
55+
### CVE-2025-49795
56+
57+
A NULL pointer dereference vulnerability was found in libxml2 when
58+
processing XPath XML expressions. This flaw allows an attacker to
59+
craft a malicious XML input to libxml2, leading to a denial of service.
60+
61+
NVD claims a severity of 7.5 High
62+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
63+
64+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278
65+
66+
### CVE-2025-49796
67+
68+
A vulnerability was found in libxml2. Processing certain sch:name
69+
elements from the input XML file can trigger a memory corruption
70+
issue. This flaw allows an attacker to craft a malicious XML input
71+
file that can lead libxml to crash, resulting in a denial of service
72+
or other possible undefined behavior due to sensitive data being
73+
corrupted in memory.
74+
75+
NVD claims a severity of 9.1 Critical
76+
(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
77+
78+
Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5
79+
80+
## Affected Versions
81+
82+
- Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2
83+
84+
## Patched Versions
85+
86+
- Nokogiri >= 1.18.9
87+
88+
## Mitigation
89+
90+
Upgrade to Nokogiri v1.18.9 or later.
91+
92+
Users who are unable to upgrade Nokogiri may also choose a more
93+
complicated mitigation: compile and link Nokogiri against patched
94+
external libxml2 libraries which will also address these same issues.
95+
patched_versions:
96+
- ">= 1.18.9"
97+
related:
98+
url:
99+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8
100+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49794
101+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49795
102+
- https://nvd.nist.gov/vuln/detail/CVE-2025-49796
103+
- https://nvd.nist.gov/vuln/detail/CVE-2025-6021
104+
- https://nvd.nist.gov/vuln/detail/CVE-2025-6170
105+
- https://github.com/sparklemotion/nokogiri/pull/3526
106+
- https://github.com/advisories/GHSA-353f-x4gh-cqq8

‎gems/thor/CVE-2025-54314.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
gem: thor
3+
cve: 2025-54314
4+
ghsa: mqcp-p2hv-vw6x
5+
url: https://github.com/advisories/GHSA-mqcp-p2hv-vw6x
6+
title: Thor can construct an unsafe shell command from library input.
7+
date: 2025-07-20
8+
description: |
9+
Thor before 1.4.0 can construct an unsafe shell command
10+
from library input.
11+
cvss_v3: 2.8
12+
patched_versions:
13+
- ">= 1.4.0"
14+
related:
15+
url:
16+
- https://nvd.nist.gov/vuln/detail/CVE-2025-54314
17+
- https://github.com/rails/thor/releases/tag/v1.4.0
18+
- https://github.com/rails/thor/pull/897
19+
- https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa
20+
- https://hackerone.com/reports/3260153
21+
- https://github.com/advisories/GHSA-mqcp-p2hv-vw6x

0 commit comments

Comments
 (0)