<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
On Mon, 05 Feb 2024 21:02:10 +0100 Salvatore Bonaccorso <carnil@debian.org> wrote:<br>
> Source: libxml2<br>
> Version: 2.9.14+dfsg-1.3<br>
> Severity: important<br>
> Tags: security upstream<br>
> Forwarded: https://gitlab.gnome.org/GNOME/libxml2/-/issues/604<br>
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org><br>
> Control: found -1 2.9.14+dfsg-1.3~deb12u1<br>
> Control: found -1 2.9.10+dfsg-6.7+deb11u4<br>
><br>
> Hi,<br>
><br>
> The following vulnerability was published for libxml2.<br>
><br>
> CVE-2024-25062[0]:<br>
> | An issue was discovered in libxml2 before 2.11.7 and 2.12.x before<br>
> | 2.12.5. When using the XML Reader interface with DTD validation and<br>
> | XInclude expansion enabled, processing crafted XML documents can<br>
> | lead to an xmlValidatePopElement use-after-free.<br>
><br>
><br>
> If you fix the vulnerability please also make sure to include the<br>
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.<br>
><br>
> For further information see:<br>
><br>
> [0] https://security-tracker.debian.org/tracker/CVE-2024-25062<br>
> https://www.cve.org/CVERecord?id=CVE-2024-25062<br>
> [1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/604<br>
> [2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7<br>
> [3] https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970884fcc13305cb8e23cdc5f0dd7667c2c<br>
><br>
> Please adjust the affected versions in the BTS as needed.<br>
><br>
> Regards,<br>
> Salvatore<br>
><br>
><br>
<div class="elementToProof"><br>
</div>
<div class="elementToProof" style="text-align: left; text-indent: 0px; line-height: 36px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I see this ticket still open from February. I had opened #1088013 recently and it was closed in favor of this ticket and was wondering what the status was. Is this ticket a request to update the libxml2 library in Debian 12?</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>