update: libxml2

[dongsupark]

Name: libxml2
CVEs: CVE-2026-6732, CVE-2026-11979
CVSSs: 6.5, 1.8
Action Needed: TBD

Summary:

• CVE-2026-6732: A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2461300
• CVE-2026-11979: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2494191

refmap.gentoo: TBD