[Pkg-libvirt-maintainers] Bug#1120584: Bug#1120584: libvirt: CVE-2025-12748

[Andrea Bolognani]

Control: found -1 libvirt/11.3.0-1

On Sat, Nov 15, 2025 at 10:08:00PM +0100, Andrea Bolognani wrote:
> On Sat, Nov 15, 2025 at 09:59:50AM +0100, Salvatore Bonaccorso wrote:
> > On Fri, Nov 14, 2025 at 11:04:06PM +0100, Andrea Bolognani wrote:
> > > On Fri, Nov 14, 2025 at 09:35:34PM +0100, Salvatore Bonaccorso wrote:
> > > > Can you prepare the update
> > > > to be included in a future point release?
> > > 
> > > To clarify, we're talking about a future *trixie* point release,
> > > right?
> > 
> > Yes, it is too late for 13.2 itself, which is happening in a few
> > minutes. We can queue this and other already and then still build on
> > top of it in case we need a DSA for other issues (I'm not aware of any
> > right now which might warrant one, althoug there is as well the
> > snapshot related issue so far).
> 
> Yes, I'm planning to include both this fix and the one for 
> #1120119 / CVE-2025-13193 in the same upload. There's another fix
> related to snapshots (see #1120389) that I might include as well if
> the timing works out right, but it doesn't have a security impact.

Draft MR here:

  https://salsa.debian.org/libvirt-team/libvirt/-/merge_requests/283

-- 
Andrea Bolognani <eof at kiyuko.org>
Resistance is futile, you will be garbage collected.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-libvirt-maintainers/attachments/20251126/79e39523/attachment.sig>