Threats Tagged 'cve-2025-67873'

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.0. These include a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114) and a heap buffer overflow via the skipdata callback (CVE-2025-67873). The heap buffer overflow can lead to denial of service or arbitrary code execution. Red Hat has released an update to address these issues in the capstone package version 4.0.2-5.el9_0 for multiple architectures. The update is rated as having a moderate security impact.

This update includes the following RPMs: capstone: * capstone-5.0.7-0.1.hum1 (aarch64, x86_64) * capstone-devel-5.0.7-0.1.hum1 (aarch64, x86_64) * capstone-java-5.0.7-0.1.hum1 (noarch) * capstone-static-5.0.7-0.1.hum1 (aarch64, x86_64) * python3-capstone-5.0.7-0.1.hum1 (noarch) * capstone-5.0.7-0.1.hum1.src (src)

Two security vulnerabilities were identified in the Capstone disassembly framework used in Red Hat Hardened Images. The first is a memory corruption issue via an unchecked vsnprintf return (CVE-2025-68114). The second, CVE-2025-67873, is a heap buffer overflow caused by improper bounds checking of the skipdata callback length, which can be exploited by a local attacker to cause denial of service or arbitrary code execution. These vulnerabilities require local access and user interaction to exploit. Red Hat has released updated Capstone RPM packages to address these issues.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 10.0 Extended Update Support. The first is a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114). The second is a heap buffer overflow triggered via the skipdata callback, which can lead to denial of service or arbitrary code execution (CVE-2025-67873). Red Hat has released an update to address these issues in the affected packages.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.6 Extended Update Support and related products. The first vulnerability (CVE-2025-68114) involves memory corruption due to an unchecked vsnprintf return value. The second vulnerability (CVE-2025-67873) is a heap buffer overflow triggered via the skipdata callback, which could lead to denial of service or arbitrary code execution. Red Hat has released updated packages to address these issues.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.2. The first is a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114). The second is a heap buffer overflow via the skipdata callback (CVE-2025-67873), which could lead to denial of service or arbitrary code execution. Red Hat has issued a security update to address these issues in the capstone package version 4.0.2-11.el9_2. The vulnerabilities are rated with moderate severity by Red Hat Product Security.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.4 Extended Update Support and related products. The first vulnerability (CVE-2025-68114) involves memory corruption caused by an unchecked vsnprintf return. The second vulnerability (CVE-2025-67873) is a heap buffer overflow triggered via the skipdata callback, which can lead to denial of service or arbitrary code execution. Red Hat has released updated packages to address these issues.

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-67873#cwe-122