CVE-2025-9714

NameCVE-2025-9714
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libxml2 (PTS)bullseye2.9.10+dfsg-6.7+deb11u4vulnerable
bullseye (security)2.9.10+dfsg-6.7+deb11u8vulnerable
bookworm, bookworm (security)2.9.14+dfsg-1.3~deb12u4vulnerable
trixie (security), trixie2.12.7+dfsg+really2.9.14-2.1+deb13u1vulnerable
forky, sid2.14.5+dfsg-0.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libxml2source(unstable)2.14.5+dfsg-0.1

Notes

[trixie] - libxml2 <no-dsa> (Minor issue; can be piggy-backed in a future update)
[bookworm] - libxml2 <no-dsa> (Minor issue; can be piggy-backed in a future update)
https://bugzilla.redhat.com/show_bug.cgi?id=2392605
https://gitlab.gnome.org/GNOME/libxslt/-/issues/148
Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21 (v2.10.0)
Test fixes in libxslt: https://gitlab.gnome.org/GNOME/libxslt/-/commit/b7994c3b7ab83b502f4298ab4abb10fb183f7ed4 (v1.1.36)
libxml2/2.14.5+dfsg-0.1 is actually not the earliest version in unstable
with the fix, but later on the version got reverted to 2.9.14 based one.

Search for package or bug name: Reporting problems