Summary
[2.62.3-9]
- Add patches to improve test reliability
- Backport patches for various CVEs
Resolves: RHEL-85879
Resolves: RHEL-92280
Resolves: RHEL-93031
Resolves: RHEL-93032
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | libsoup | 0:2.62.3-9.el8_10 |
| Oracle Linux · 8 | libsoup-devel | 0:2.62.3-9.el8_10 |
Vulnerabilities 4
-
High 7.5
Libsoup: denial of service attack to websocket server
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
-
High 7.5
Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messag…
-
High 7.4
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
-
High 7.0
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.