cbcvebase.
CVE-2025-6170
published 2025-06-16

CVE-2025-6170: A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program…

low2.5CVSS 3.1
AVLACHPRNUIRSUCNINAL
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlibxml2< libxml2 2.9.14+dfsg-1.3~deb12u3 (bookworm)libxml2 2.9.14+dfsg-1.3~deb12u3 (bookworm)
msrcazl3_libxml2_2.11.5-6_on_azure_linux_3.0——
msrccbl2_libxml2_2.10.4-8_on_cbl_mariner_2.0——
msrccm2_libxml2_2.10.4-8_on_cbl_mariner_2.0——
nokogirinokogiri>= 0 < 1.18.91.18.9
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatopenshift_container_platform——
xmlsoftlibxml2>= 0 < 2.9.10+dfsg-6.7+deb11u82.9.10+dfsg-6.7+deb11u8
xmlsoftlibxml2>= 0 < 2.9.14+dfsg-1.3~deb12u32.9.14+dfsg-1.3~deb12u3
xmlsoftlibxml2>= 0 < 2.12.7+dfsg+really2.9.14-2.12.12.7+dfsg+really2.9.14-2.1
xmlsoftlibxml2>= 0 < 2.12.7+dfsg+really2.9.14-2.12.12.7+dfsg+really2.9.14-2.1
xmlsoftlibxml2>= 0 < 2.9.13+dfsg-1ubuntu0.82.9.13+dfsg-1ubuntu0.8
xmlsoftlibxml2>= 0 < 2.9.14+dfsg-1.3ubuntu3.42.9.14+dfsg-1.3ubuntu3.4
xmlsoftlibxml2>= 0 < 2.9.1+dfsg1-3ubuntu4.13+esm82.9.1+dfsg1-3ubuntu4.13+esm8
xmlsoftlibxml2>= 0 < 2.9.3+dfsg1-1ubuntu0.7+esm92.9.3+dfsg1-1ubuntu0.7+esm9
xmlsoftlibxml2>= 0 < 2.9.4+dfsg1-6.1ubuntu1.9+esm42.9.4+dfsg1-6.1ubuntu1.9+esm4
xmlsoftlibxml2>= 0 < 2.9.10+dfsg-5ubuntu0.20.04.10+esm12.9.10+dfsg-5ubuntu0.20.04.10+esm1

CVSS provenance

nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
ghsa9.1CRITICAL
osv9.1CRITICAL