Comment 7 for bug 1752306

The 14.04 LTS xmltooling package shows up on http://people.canonical.com/~ubuntu-security/d2u/ so there's a good chance we'll release a fakesync from Debian to address this for trusty, but other releases will need someone from the community to prepare and test a debdiff. Once it's ready, attach it here, and subscribe ubuntu-security-sponsors.

Thanks