Threats Tagged 'cve-2025-68114'

A low severity security vulnerability (CVE-2025-68114) was identified in the Capstone disassembly framework used for binary analysis and reversing. The issue involves memory corruption caused by an unchecked vsnprintf return value. Red Hat has released an update for Red Hat Enterprise Linux 9 and related variants to address this vulnerability. The advisory rates the impact as low and provides updated packages to remediate the issue.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.0. These include a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114) and a heap buffer overflow via the skipdata callback (CVE-2025-67873). The heap buffer overflow can lead to denial of service or arbitrary code execution. Red Hat has released an update to address these issues in the capstone package version 4.0.2-5.el9_0 for multiple architectures. The update is rated as having a moderate security impact.

This update includes the following RPMs: capstone: * capstone-5.0.7-0.1.hum1 (aarch64, x86_64) * capstone-devel-5.0.7-0.1.hum1 (aarch64, x86_64) * capstone-java-5.0.7-0.1.hum1 (noarch) * capstone-static-5.0.7-0.1.hum1 (aarch64, x86_64) * python3-capstone-5.0.7-0.1.hum1 (noarch) * capstone-5.0.7-0.1.hum1.src (src)

Two security vulnerabilities were identified in the Capstone disassembly framework used in Red Hat Hardened Images. The first is a memory corruption issue via an unchecked vsnprintf return (CVE-2025-68114). The second, CVE-2025-67873, is a heap buffer overflow caused by improper bounds checking of the skipdata callback length, which can be exploited by a local attacker to cause denial of service or arbitrary code execution. These vulnerabilities require local access and user interaction to exploit. Red Hat has released updated Capstone RPM packages to address these issues.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 10.0 Extended Update Support. The first is a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114). The second is a heap buffer overflow triggered via the skipdata callback, which can lead to denial of service or arbitrary code execution (CVE-2025-67873). Red Hat has released an update to address these issues in the affected packages.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.6 Extended Update Support and related products. The first vulnerability (CVE-2025-68114) involves memory corruption due to an unchecked vsnprintf return value. The second vulnerability (CVE-2025-67873) is a heap buffer overflow triggered via the skipdata callback, which could lead to denial of service or arbitrary code execution. Red Hat has released updated packages to address these issues.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.2. The first is a memory corruption issue caused by an unchecked vsnprintf return (CVE-2025-68114). The second is a heap buffer overflow via the skipdata callback (CVE-2025-67873), which could lead to denial of service or arbitrary code execution. Red Hat has issued a security update to address these issues in the capstone package version 4.0.2-11.el9_2. The vulnerabilities are rated with moderate severity by Red Hat Product Security.

Two security vulnerabilities have been identified in the Capstone disassembly framework used in Red Hat Enterprise Linux 9.4 Extended Update Support and related products. The first vulnerability (CVE-2025-68114) involves memory corruption caused by an unchecked vsnprintf return. The second vulnerability (CVE-2025-67873) is a heap buffer overflow triggered via the skipdata callback, which can lead to denial of service or arbitrary code execution. Red Hat has released updated packages to address these issues.

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-68114#cwe-124