Not qualyfied - CVE-2025-49795

Vulnerability identifier: #VU111222

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-49795

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

This issue does not qualify for vulnerability definition as it is present in the dev code that was never released outside of the dev tree. 

The original description:

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the xmlSchematronFormatReport() function when processing incorrect XPath expressions in Schematron schema reports. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

IBM Decision Optimization for Cloud Pak for Data
Traffix SDC
WatsonX BI Assistant
LANTIME Operating System Firmware (LTOS)
Anolis OS
openEuler
libxml2-help
python3-libxml2
libxml2-devel
libxml2-debugsource
libxml2-debuginfo
libxml2
libxml2-doc
libxml2-static
libxml2-debugsource (Red Hat package)
libxml2-static (Red Hat package)
python3-libxml2-debuginfo (Red Hat package)
libxml2-debuginfo (Red Hat package)

Install update from vendor's website.

IBM Decision Optimization for Cloud Pak for Data - update to 5.2.1
WatsonX BI Assistant - update to 5.2.1
LANTIME Operating System Firmware (LTOS) - update to 7.10.004
libxml2-help - addressed in versions 2.11.5-8, 2.11.9-5
python3-libxml2 - addressed in versions 2.11.5-8, 2.11.9-5
libxml2-devel - addressed in versions 2.11.5-8, 2.11.9-5
libxml2-debugsource - addressed in versions 2.11.5-8, 2.11.9-5
libxml2-debuginfo - addressed in versions 2.11.5-8, 2.11.9-5
libxml2 - addressed in versions 2.11.5-8, 2.11.9-5
libxml2-doc - update to 2.11.5-15
libxml2 - update to 2.11.5-15
libxml2-devel - update to 2.11.5-15
libxml2-static - update to 2.11.5-15
python3-libxml2 - update to 2.11.5-15
libxml2-debugsource (Red Hat package) - update to 2.12.5-7.el10_0
libxml2-static (Red Hat package) - update to 2.12.5-7.el10_0
python3-libxml2-debuginfo (Red Hat package) - update to 2.12.5-7.el10_0
libxml2-debuginfo (Red Hat package) - update to 2.12.5-7.el10_0

• https://bugzilla.redhat.com/show_bug.cgi?id=2372379
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/932

• Red Hat Enterprise Linux 10 update for libxml2
• openEuler 24.03 LTS SP2 update for libxml2
• openEuler 24.03 LTS SP1 update for libxml2
• openEuler 24.03 LTS update for libxml2
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple libxml2 vulnerabilities in F5 Traffix SDC
• Anolis OS update for libxml2
• Multiple vulnerabilities in IBM WatsonX BI Assistant
• Meinberg LANTIME firmware update for third-party components