libxml2-2-2.9.12-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11016-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libxml2-2-2.9.12-1.2 on GA media These are all security issues fixed in the libxml2-2-2.9.12-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11016 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2007-6284/ SUSE CVE CVE-2007-6284 page https://www.suse.com/security/cve/CVE-2016-4658/ SUSE CVE CVE-2016-4658 page https://www.suse.com/security/cve/CVE-2017-0663/ SUSE CVE CVE-2017-0663 page https://www.suse.com/security/cve/CVE-2017-5969/ SUSE CVE CVE-2017-5969 page https://www.suse.com/security/cve/CVE-2017-9047/ SUSE CVE CVE-2017-9047 page https://www.suse.com/security/cve/CVE-2017-9048/ SUSE CVE CVE-2017-9048 page https://www.suse.com/security/cve/CVE-2017-9049/ SUSE CVE CVE-2017-9049 page https://www.suse.com/security/cve/CVE-2018-14404/ SUSE CVE CVE-2018-14404 page https://www.suse.com/security/cve/CVE-2018-9251/ SUSE CVE CVE-2018-9251 page https://www.suse.com/security/cve/CVE-2019-19956/ SUSE CVE CVE-2019-19956 page https://www.suse.com/security/cve/CVE-2019-20388/ SUSE CVE CVE-2019-20388 page https://www.suse.com/security/cve/CVE-2020-24977/ SUSE CVE CVE-2020-24977 page https://www.suse.com/security/cve/CVE-2020-7595/ SUSE CVE CVE-2020-7595 page https://www.suse.com/security/cve/CVE-2021-3516/ SUSE CVE CVE-2021-3516 page https://www.suse.com/security/cve/CVE-2021-3517/ SUSE CVE CVE-2021-3517 page https://www.suse.com/security/cve/CVE-2021-3518/ SUSE CVE CVE-2021-3518 page https://www.suse.com/security/cve/CVE-2021-3537/ SUSE CVE CVE-2021-3537 page https://www.suse.com/security/cve/CVE-2021-3541/ SUSE CVE CVE-2021-3541 page openSUSE Tumbleweed libxml2-2-2.9.12-1.2 libxml2-2-32bit-2.9.12-1.2 libxml2-devel-2.9.12-1.2 libxml2-devel-32bit-2.9.12-1.2 libxml2-doc-2.9.12-1.2 libxml2-tools-2.9.12-1.2 libxml2-2-2.9.12-1.2 as a component of openSUSE Tumbleweed libxml2-2-32bit-2.9.12-1.2 as a component of openSUSE Tumbleweed libxml2-devel-2.9.12-1.2 as a component of openSUSE Tumbleweed libxml2-devel-32bit-2.9.12-1.2 as a component of openSUSE Tumbleweed libxml2-doc-2.9.12-1.2 as a component of openSUSE Tumbleweed libxml2-tools-2.9.12-1.2 as a component of openSUSE Tumbleweed The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences. CVE-2007-6284 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6284.html CVE-2007-6284 https://bugzilla.suse.com/349151 SUSE Bug 349151 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document. CVE-2016-4658 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-4658.html CVE-2016-4658 https://bugzilla.suse.com/1005544 SUSE Bug 1005544 https://bugzilla.suse.com/1014873 SUSE Bug 1014873 https://bugzilla.suse.com/1069433 SUSE Bug 1069433 https://bugzilla.suse.com/1078813 SUSE Bug 1078813 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. CVE-2017-0663 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-0663.html CVE-2017-0663 https://bugzilla.suse.com/1044337 SUSE Bug 1044337 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser." CVE-2017-5969 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5969.html CVE-2017-5969 https://bugzilla.suse.com/1024989 SUSE Bug 1024989 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9047 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9047.html CVE-2017-9047 https://bugzilla.suse.com/1039063 SUSE Bug 1039063 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039657 SUSE Bug 1039657 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9048 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9048.html CVE-2017-9048 https://bugzilla.suse.com/1039064 SUSE Bug 1039064 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039658 SUSE Bug 1039658 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. CVE-2017-9049 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-9049.html CVE-2017-9049 https://bugzilla.suse.com/1039063 SUSE Bug 1039063 https://bugzilla.suse.com/1039064 SUSE Bug 1039064 https://bugzilla.suse.com/1039066 SUSE Bug 1039066 https://bugzilla.suse.com/1039659 SUSE Bug 1039659 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/1069690 SUSE Bug 1069690 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application. CVE-2018-14404 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14404.html CVE-2018-14404 https://bugzilla.suse.com/1102046 SUSE Bug 1102046 https://bugzilla.suse.com/1148896 SUSE Bug 1148896 The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035. CVE-2018-9251 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 low 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-9251.html CVE-2018-9251 https://bugzilla.suse.com/1088279 SUSE Bug 1088279 https://bugzilla.suse.com/1088601 SUSE Bug 1088601 https://bugzilla.suse.com/1105166 SUSE Bug 1105166 xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs. CVE-2019-19956 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-19956.html CVE-2019-19956 https://bugzilla.suse.com/1159928 SUSE Bug 1159928 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. CVE-2019-20388 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-20388.html CVE-2019-20388 https://bugzilla.suse.com/1161521 SUSE Bug 1161521 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. CVE-2020-24977 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-24977.html CVE-2020-24977 https://bugzilla.suse.com/1176179 SUSE Bug 1176179 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVE-2020-7595 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-7595.html CVE-2020-7595 https://bugzilla.suse.com/1161517 SUSE Bug 1161517 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability. CVE-2021-3516 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3516.html CVE-2021-3516 https://bugzilla.suse.com/1185409 SUSE Bug 1185409 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application. CVE-2021-3517 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3517.html CVE-2021-3517 https://bugzilla.suse.com/1185410 SUSE Bug 1185410 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 https://bugzilla.suse.com/1194438 SUSE Bug 1194438 https://bugzilla.suse.com/1196383 SUSE Bug 1196383 There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability. CVE-2021-3518 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3518.html CVE-2021-3518 https://bugzilla.suse.com/1185408 SUSE Bug 1185408 https://bugzilla.suse.com/1191860 SUSE Bug 1191860 A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. CVE-2021-3537 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3537.html CVE-2021-3537 https://bugzilla.suse.com/1185698 SUSE Bug 1185698 A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. CVE-2021-3541 openSUSE Tumbleweed:libxml2-2-2.9.12-1.2 openSUSE Tumbleweed:libxml2-2-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-2.9.12-1.2 openSUSE Tumbleweed:libxml2-devel-32bit-2.9.12-1.2 openSUSE Tumbleweed:libxml2-doc-2.9.12-1.2 openSUSE Tumbleweed:libxml2-tools-2.9.12-1.2 moderate 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3541.html CVE-2021-3541 https://bugzilla.suse.com/1186015 SUSE Bug 1186015