Red Hat Security AdvisoryRHSA-2025:21657
libsoup security update
Released 2025-11-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7 ELS) libsoup-2.62.2-9.el7_9, libsoup-2.62.2-9.el7_9.ppc, libsoup-devel-2.62.2-9.el7_9 +1
Fixes 9 records
Priority HIGH 72
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01121 · Published 2025-05-19 · Partial fix · 3.6.5-3.el10_0.6, 2.62.2-9.el7_9 +9 CWE-191
Priority MEDIUM 64
A flaw was found in libsoup.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00876 · Published 2025-04-03 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +10 CWE-125
Priority MEDIUM 51
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00699 · Published 2025-05-19 · Partial fix · 3.6.5-3.el10_0.9, 3.6.5-3.el10_1.6 +11 CWE-190
Priority MEDIUM 43
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function.
CVSS 3.1CRITICAL 9.0· Network · No auth · No interaction · EPSS 0.00966 · Published 2025-04-15 · Partial fix · 3.6.3, 2.62.2-9.el7_9 +11 CWE-590
Priority MEDIUM 41
A flaw was found in libsoup.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01074 · Published 2025-04-03 · Partial fix · 3.6.5-3.el10_0.6, 2.62.2-9.el7_9 +9 CWE-770
Priority MEDIUM 40
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00856 · Published 2025-04-14 · Partial fix · 3.6.2, 2.62.2-9.el7_9 +11 CWE-476
Priority MEDIUM 40
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00636 · Published 2025-09-26 · Partial fix · 3.6.5-3.el10_0.7, 3.6.5-3.el10_1.6 +11 CWE-125
Priority LOW 35
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01286 · Published 2025-04-14 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +12 CWE-125
Priority LOW 34
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00786 · Published 2025-04-14 · Partial fix · 3.6.5, 3.6.5-3.el10_0 +10 CWE-125
THREATIST.IORead the docs