Summary
[2.72.0-10.2]
- Backport patches for various CVEs
Resolves: RHEL-85888
Resolves: RHEL-87081
Resolves: RHEL-88332
Resolves: RHEL-92285
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | libsoup | 0:2.72.0-10.el9_6.2 |
| Oracle Linux · 9 | libsoup-devel | 0:2.72.0-10.el9_6.2 |
Vulnerabilities 4
-
High 7.5
Libsoup: denial of service attack to websocket server
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
-
High 7.5
Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
High 7.0
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.