CVE-2025-27113

NameCVE-2025-27113
Descriptionlibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4064-1
Debian Bugs1098322

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxml2 (PTS)bullseye2.9.10+dfsg-6.7+deb11u4vulnerable
bullseye (security)2.9.10+dfsg-6.7+deb11u6fixed
bookworm2.9.14+dfsg-1.3~deb12u1vulnerable
trixie2.12.7+dfsg+really2.9.14-0.3vulnerable
sid2.12.7+dfsg+really2.9.14-0.4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxml2sourcebullseye2.9.10+dfsg-6.7+deb11u6DLA-4064-1
libxml2source(unstable)2.12.7+dfsg+really2.9.14-0.41098322

Notes

https://gitlab.gnome.org/GNOME/libxml2/-/issues/861
https://www.openwall.com/lists/oss-security/2025/02/18/2
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/6c716d491dd2e67f08066f4dc0619efeb49e43e6
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/503f788e84f1c1f1d769c2c7258d77faee94b5a3 (v2.12.10)

Search for package or bug name: Reporting problems