Summary
It was discovered that libsoup could be made to read out of bounds. An
attacker could possibly use this issue to cause applications using
libsoup to crash, resulting in a denial of service. (CVE-2025-2784,
CVE-2025-32050, CVE-2025-32052, CVE-2025-32053)
It was discovered that libsoup could be made to dereference invalid
memory. An attacker could possibly use this issue to cause applications
using libsoup to crash, resulting in a denial of service.
(CVE-2025-32051)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libsoup2.4 | 2.70.0-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | libsoup2.4 | 2.74.2-3ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup2.4 | 2.74.3-6ubuntu1.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | libsoup3 | 3.4.4-5ubuntu0.2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libsoup3 | 3.0.7-0ubuntu1+esm2 |
Vulnerabilities 5
-
High 7.0
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
-
Medium 6.5
Libsoup: heap buffer overflow in sniff_unknown()
A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.
-
Medium 6.5
Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()
A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.
-
Medium 5.9
Libsoup: integer overflow in append_param_quoted
A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.
-
Medium 5.9
Libsoup: segmentation fault when parsing malformed data uri
A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS).