[xml/sgml-pkgs] Bug#1118078: libxslt: CVE-2025-11731

[Salvatore Bonaccorso]

Source: libxslt
Version: 1.1.43-0.2
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/libxslt/-/issues/151
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 1.1.35-1
Control: found -1 1.1.35-1+deb12u2
Control: found -1 1.1.35-1+deb12u3
Control: found -1 1.1.35-1.2+deb13u1
Control: found -1 1.1.35-1.2+deb13u2

Hi,

The following vulnerability was published for libxslt.

CVE-2025-11731[0]:
| A flaw was found in the exsltFuncResultComp() function of libxslt,
| which handles EXSLT <func:result> elements during stylesheet
| parsing. Due to improper type handling, the function may treat an
| XML document node as a regular XML element node, resulting in a type
| confusion. This can cause unexpected memory reads and potential
| crashes. While difficult to exploit, the flaw could lead to
| application instability or denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-11731
    https://www.cve.org/CVERecord?id=CVE-2025-11731
[1] https://gitlab.gnome.org/GNOME/libxslt/-/issues/151
[2] https://gitlab.gnome.org/GNOME/libxslt/-/commit/fe508f201efb9ea37bfbe95413b8b28251497de3

Regards,
Salvatore