QSN-8787-1: libxml2 vulnerabilities
2026-09-21

Summary:
Several security issues were fixed in libxml2.

Details:
It was discovered that libxml2 incorrectly handled certain XML elements
under certain circumstances. An attacker could possibly use this issue to
cause libxml2 to crash or execute arbitrary code. (CVE-2026-86140)

It was discovered that libxml2 incorrectly handled certain XML documents
when used with Python bindings. A remote attacker could possibly use this
issue to cause applications using libxml2 to crash, resulting in a denial
of service. (CVE-2026-74860)

Affected QuantaStor releases:
  6.9.1.001 jammy: libxml2 2.9.13+dfsg-1ubuntu0.14 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.9.1.001 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.14 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.9.0.464 jammy: libxml2 2.9.13+dfsg-1ubuntu0.14 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.9.0.464 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.14 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.6.015 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.6.015 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.5.018 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.5.018 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.4.038 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.4.038 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.3.018 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.3.018 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.2.002 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.2.002 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.1.007 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.1.007 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.0.205 jammy: libxml2 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)
  6.8.0.205 jammy: libxml2-utils 2.9.13+dfsg-1ubuntu0.12 (fixed in 2.9.13+dfsg-1ubuntu0.13)

CVEs: CVE-2026-86140, CVE-2026-74860

References:
  https://ubuntu.com/security/notices/USN-8787-1