Package: libxml2 Severity: normal User: [email protected] Hi,
This is regarding to the following vulnerability published for libxml2. CVE-2025-27113<https://security-tracker.debian.org/tracker/CVE-2025-27113>[0]: | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer | dereference in xmlPatMatch in pattern.c. This vulnerability has been addressed in the bullseye release, but since it pertains to an older version, we would like to inquire when it will be fixed in the upcoming sid, Trixie releases. Source Package Release Version Status libxml2<https://security-tracker.debian.org/tracker/source-package/libxml2> (PTS<https://tracker.debian.org/pkg/libxml2>) bullseye 2.9.10+dfsg-6.7+deb11u4 vulnerable bullseye (security) 2.9.10+dfsg-6.7+deb11u6 fixed bookworm 2.9.14+dfsg-1.3~deb12u1 vulnerable sid, trixie 2.12.7+dfsg+really2.9.14-0.2 vulnerable Looking forward to your response. Best regards, Hemlata Chandewar
