Multiple security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. These include out-of-bounds reads, denial of service via overlapping Range headers, double free, NULL pointer dereference, information disclosure through improper Authorization header forwarding, and memory leaks. Red Hat has issued an important security advisory with updates addressing these issues.
Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 8. These include issues that may cause unexpected process crashes, denial-of-service conditions, cross-origin data exfiltration, and cross-site scripting attacks via malicious web content or iframes. Red Hat has issued an important security advisory with updates to address these vulnerabilities.
CVE-2025-32911 is a critical use-after-free vulnerability in libsoup's soup_message_headers_get_content_disposition() function. It allows a malicious HTTP client to cause memory corruption in the libsoup server, potentially leading to severe impacts including confidentiality, integrity, and availability loss. Red Hat has issued a security advisory with an update that fixes this and other related vulnerabilities in libsoup for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
CVE-2025-32914 is an out-of-bounds read vulnerability in the libsoup library, specifically in the soup_multipart_new_from_message() function. This flaw allows a malicious HTTP client to cause the libsoup server to read memory out of bounds, potentially leading to a crash or process exit. The vulnerability has a CVSS score of 7.4, indicating high severity, with impact on confidentiality and availability. Red Hat has issued an important security advisory with updates addressing this and related libsoup vulnerabilities. The flaw affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions and is fixed in updated packages.
CVE-2025-32913 is a vulnerability in libsoup's soup_message_headers_get_content_disposition() function that causes a NULL pointer dereference. This flaw can be triggered by a malicious HTTP peer sending a Content-Disposition header with a filename parameter that is present but has no value, leading to a crash of the libsoup client or server using this function.
CVE-2025-32049 is a denial of service vulnerability in libsoup's SoupWebsocketConnection component. It allows a large WebSocket message to cause excessive memory allocation, potentially leading to a crash or service disruption. This flaw has a high severity rating with a CVSS score of 7.5. Red Hat has issued an important security update addressing this issue in Red Hat Enterprise Linux 7 Extended Lifecycle Support.
CVE-2025-2784 is a heap buffer over-read vulnerability in libsoup, an HTTP client and server library for GNOME. The flaw occurs in the skip_insignificant_space() function when sniffing content, allowing libsoup clients to read one byte out-of-bounds in response to a crafted HTTP response from a malicious HTTP server. This vulnerability has a CVSS score of 7.0, indicating high severity, with impacts including limited confidentiality and integrity loss and high availability impact. Red Hat has issued an important security update addressing this issue in Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Multiple security issues were addressed in the go1.24-1.24.2-1.1 package for openSUSE Tumbleweed. These fixes are included in the GA media release. No specific details about the vulnerabilities or affected versions are provided.
Multiple security issues were addressed in the go1.24-1.24.1-1.1 package for openSUSE Tumbleweed. These fixes are included in the GA media release of this package by the SUSE Product Security Team.
Red Hat has issued a security advisory for webkit2gtk3 addressing vulnerabilities that could lead to memory corruption and unexpected process crashes when processing maliciously crafted web content. These issues affect the WebKitGTK port of the WebKit rendering engine on the GTK platform. The update is rated as Important by Red Hat and is available for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants.
A security update for crun addresses multiple issues including CVE-2025-24965, where the .krun_config.json file could be created outside of the container root filesystem. The update also reverts a previous removal of tun/tap devices from the default allow list, fixes hangs related to tty reads, improves error handling, and resolves other container management bugs. The vulnerability CVE-2025-24965 is specifically fixed in version 1.20.
A security update for the SUSE Linux Enterprise 15 SP5 RT kernel addresses multiple security vulnerabilities across various kernel components including DRM, ALSA, networking, SCSI, and others. The update fixes issues such as use-after-free, race conditions, memory leaks, and pointer validation errors. These vulnerabilities could potentially lead to system instability or security breaches if exploited. The update also includes fixes for several non-security bugs to improve system functionality.
Multiple security issues were addressed in the go1.24-1.24rc3-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities present in prior versions of the Go language package distributed by SUSE. No specific details about the nature of the vulnerabilities or affected versions are provided.
The go1.24-1.24rc2-1.1 package on the GA media of openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities have been fixed in this package version by the SUSE Product Security Team. No specific details about the nature of the vulnerabilities or affected versions are provided.
This entry refers to a security update for PHP provided by the SUSE Product Security Team, which is functionally equivalent to Red Hat's advisory RHSA-2024:10949. The update addresses vulnerabilities identified under CVE-2024-2756 and related CVEs. No specific affected versions or detailed vulnerability descriptions are provided in the input data.
Multiple updates to Helm versions address various bugs, improvements, and security fixes including validation issues and uninitialized variable handling in YAML parsing. Notably, versions 3.14.1 and 3.14.2 address CVE-2024-25620 and CVE-2024-26147 respectively. Users are encouraged to upgrade to these fixed versions for improved stability and security.