DEBIAN-CVE-2025-8732

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-8732
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-8732.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-8732
Upstream
Published
2025-08-08T17:15:30Z
Modified
2026-09-01T20:05:59Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

References

Affected packages

Debian:12 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.9.14+dfsg-1.3~deb12u6

Affected versions

2.*
2.9.14+dfsg-1.2
2.9.14+dfsg-1.3~deb12u1
2.9.14+dfsg-1.3~deb12u2
2.9.14+dfsg-1.3~deb12u3
2.9.14+dfsg-1.3~deb12u4
2.9.14+dfsg-1.3~deb12u5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-8732.json"

Debian:13 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.12.7+dfsg+really2.9.14-2.1+deb13u3

Affected versions

2.*
2.12.7+dfsg+really2.9.14-2.1
2.12.7+dfsg+really2.9.14-2.1+deb13u1
2.12.7+dfsg+really2.9.14-2.1+deb13u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-8732.json"

Debian:14 / libxml2

Package

Name
libxml2
Purl
pkg:deb/debian/libxml2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.15.2+dfsg-0.1

Affected versions

2.*
2.12.7+dfsg+really2.9.14-2.1
2.13.1+dfsg-0exp1
2.13.3+dfsg-0exp1
2.13.3+dfsg-0exp2
2.14.1+dfsg-0exp1
2.14.2+dfsg-0exp1
2.14.3+dfsg-0exp1
2.14.3+dfsg-0exp2
2.14.3+dfsg-0exp3
2.14.4+dfsg-0exp1
2.14.5+dfsg-0exp1
2.14.5+dfsg-0exp2
2.14.5+dfsg-0.1
2.14.5+dfsg-0.2
2.14.6+dfsg-0.1
2.15.0+dfsg-0.1
2.15.0+dfsg-0.2
2.15.0+dfsg-0.3
2.15.1+dfsg-0.1
2.15.1+dfsg-0.2
2.15.1+dfsg-0.3
2.15.1+dfsg-0.4
2.15.1+dfsg-0.5
2.15.1+dfsg-1
2.15.1+dfsg-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-8732.json"