Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32910: A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash. CVE-2025-32909: A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash. CVE-2025-32053: A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read. CVE-2025-32052: A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. CVE-2025-32050: A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libsoup | 0:2.72.0-6.amzn2023.0.11 |
| Amazon Linux · 2023 | libsoup-debuginfo | 0:2.72.0-6.amzn2023.0.11 |
| Amazon Linux · 2023 | libsoup-debugsource | 0:2.72.0-6.amzn2023.0.11 |
| Amazon Linux · 2023 | libsoup-devel | 0:2.72.0-6.amzn2023.0.11 |
| Amazon Linux · 2023 | libsoup-doc | 0:2.72.0-6.amzn2023.0.11 |
Vulnerabilities 5
-
Medium 6.5
Libsoup: heap buffer overflow in sniff_unknown()
A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.
-
Medium 6.5
Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()
A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.
-
Medium 6.5
Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication
A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.
-
Medium 5.9
Libsoup: integer overflow in append_param_quoted
A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.
-
Medium 5.3
Libsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c
A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server may cause the libsoup client to crash.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32050.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32052.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32053.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32909.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-32910.html