Summary
It was discovered that FastCGI incorrectly handled certain parameter
lengths, leading to an integer overflow and a heap-based buffer
overflow. An attacker could possibly use this issue to cause
applications using FastCGI to crash, resulting in a denial of service,
or execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libfcgi | 2.4.0-8.3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libfcgi | 2.4.0-10ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libfcgi | 2.4.0-10ubuntu0.20.04.1~esm1 |
Vulnerabilities 1
-
Critical 9.3
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via craft…
References
-
report
https://ubuntu.com/security/CVE-2025-23016