Untriaged
Permalink
CVE-2025-32911
9.0 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4"
Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
A flaw was found in libsoup, which is vulnerable to a use-after-free memory issue not on the heap in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
References
Affected products
libsoup
- *
- <3.6.3
libsoup3
mingw-freetype
- *
spice-client-win
- *
Matching in nixpkgs
pkgs.libsoup_2_4
HTTP client/server library for GNOME
-
nixos-unstable -
- nixpkgs-unstable 2.74.3
Package maintainers
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@hedning Tor Hedin Brønner <torhedinbronner@gmail.com>
-
@dasj19 Daniel Șerbănescu <daniel@serbanescu.dk>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>
-
@lovek323 Jason O'Conal <jason@oconal.id.au>
-
@bobby285271 Bobby Rong <rjl931189261@126.com>