p PatchFirst

RLSA-2025:4560

RLSA-2025:4560 · Important: libsoup security update

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: Integer overflow in append_param_quoted (CVE-2025-32050) * libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052) * libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() (CVE-2025-32053) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value (CVE-2025-32911) * libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header (CVE-2025-32913) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) * libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c (CVE-2025-46420) * libsoup: Integer overflow in append_param_quoted [rhel-8.10.z] (CVE-2025-32050) * libsoup: Heap buffer overflow in sniff_unknown() [rhel-8.10.z] (CVE-2025-32052) * libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() [rhel-8.10.z] (CVE-2025-32053) * libsoup: Out of bounds reads in soup_headers_parse_request() [rhel-8.10.z] (CVE-2025-32906) * libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value [rhel-8.10.z] (CVE-2025-32911) * libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header [rhel-8.10.z] (CVE-2025-32913) * libsoup: Memory leak on soup_header_parse_quality_list() via soup-headers.c [rhel-8.10.z] (CVE-2025-46420) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server [rhel-8.10.z] (CVE-2025-46421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

CVSS 9.0 · Критический · Есть исправление

Опубликовано
Обновлено

Стек: system

Затронутые продукты и версии

  • libsoup Rocky Linux:8

    Затронутые диапазоны версий
    • ECOSYSTEM: < 0:2.62.3-8.el8_10

    Обновитесь до 0:2.62.3-8.el8_10

Первоисточники

Проверьте свой сервер →