Threats Tagged 'cve-2025-32907'

This Red Hat security advisory addresses multiple vulnerabilities in the mingw-freetype library and libsoup components affecting Red Hat Enterprise Linux 8. The issues include out-of-bounds writes, integer overflows, heap buffer overflows, null pointer dereferences, double frees, and denial of service conditions. These vulnerabilities impact font parsing and HTTP request handling functionality. The advisory rates the overall security impact as Important and provides updates to mitigate these issues.

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Denial of Service attack to websocket server (CVE-2025-32049) * libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907) * libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035) * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9. These include integer overflow, heap buffer overflows, out-of-bounds reads, denial of service, double free, null pointer dereference, information disclosure, and memory leak issues. The vulnerabilities are addressed in a security update released by Red Hat. The update is rated as Important by Red Hat Product Security. Users of affected Red Hat Enterprise Linux 9 variants should apply the update to mitigate these issues.

Multiple security vulnerabilities have been identified and fixed in the libsoup HTTP client and server library for GNOME, as addressed by Red Hat in their security advisory RHSA-2025:4508. These include integer overflows, heap buffer overflows, out-of-bounds reads, denial of service, double free, null pointer dereference, information disclosure, and memory leaks. The vulnerabilities affect Red Hat Enterprise Linux 9.2 variants and related products. Red Hat has released updated packages to remediate these issues.

Multiple security vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. These include integer overflow, heap buffer overflows, out-of-bounds reads, denial of service, double free, null pointer dereference, information disclosure, and memory leak issues. The vulnerabilities are addressed in an update provided by Red Hat. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support versions should apply the security update to remediate these issues.