<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello. Is it possible to get an update on this issue? Is there some other place I should be checking the status? Any info would be greatly appreciated.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Jay </div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Jay Pelletier<br>
<b>Sent:</b> Monday, November 25, 2024 2:53 PM<br>
<b>To:</b> 1063234@bugs.debian.org <1063234@bugs.debian.org><br>
<b>Subject:</b> Re: libxml2: CVE-2024-25062</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">On Mon, 05 Feb 2024 21:02:10 +0100 Salvatore Bonaccorso <carnil@debian.org> wrote:<br>
> Source: libxml2<br>
> Version: 2.9.14+dfsg-1.3<br>
> Severity: important<br>
> Tags: security upstream<br>
> Forwarded: https://gitlab.gnome.org/GNOME/libxml2/-/issues/604<br>
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org><br>
> Control: found -1 2.9.14+dfsg-1.3~deb12u1<br>
> Control: found -1 2.9.10+dfsg-6.7+deb11u4<br>
><br>
> Hi,<br>
><br>
> The following vulnerability was published for libxml2.<br>
><br>
> CVE-2024-25062[0]:<br>
> | An issue was discovered in libxml2 before 2.11.7 and 2.12.x before<br>
> | 2.12.5. When using the XML Reader interface with DTD validation and<br>
> | XInclude expansion enabled, processing crafted XML documents can<br>
> | lead to an xmlValidatePopElement use-after-free.<br>
><br>
><br>
> If you fix the vulnerability please also make sure to include the<br>
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.<br>
><br>
> For further information see:<br>
><br>
> [0] https://security-tracker.debian.org/tracker/CVE-2024-25062<br>
> https://www.cve.org/CVERecord?id=CVE-2024-25062<br>
> [1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/604<br>
> [2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7<br>
> [3] https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970884fcc13305cb8e23cdc5f0dd7667c2c<br>
><br>
> Please adjust the affected versions in the BTS as needed.<br>
><br>
> Regards,<br>
> Salvatore<br>
><br>
><br>
<div class="x_elementToProof"><br>
</div>
<div class="x_elementToProof" style="text-align:left; text-indent:0px; line-height:36px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I see this ticket still open from February. I had opened #1088013 recently and it was closed in favor of this ticket and was wondering what the status was. Is this ticket a request to update the libxml2 library in Debian 12?</div>
<div class="x_elementToProof" style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
</div>
</body>
</html>