[xml/sgml-pkgs] Bug#1120364: libxml2: CVE-2025-12863

[Salvatore Bonaccorso]

Source: libxml2
Version: 2.15.1+dfsg-0.3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libxml2.

CVE-2025-12863[0]:
| A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML
| parsing library. This function is responsible for updating document
| pointers when XML nodes are moved between documents. Due to improper
| handling of namespace references, a namespace pointer may remain
| linked to a freed memory region when the original document is
| destroyed. As a result, subsequent operations that access the
| namespace can lead to a use-after-free condition, causing an
| application crash.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-12863
    https://www.cve.org/CVERecord?id=CVE-2025-12863
[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore