SB2024111329 - Multiple vulnerabilities in GNOME libsoup

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024111329

SB2024111329 - Multiple vulnerabilities in GNOME libsoup

Published: November 13, 2024 Updated: May 29, 2025

Security Bulletin ID SB2024111329
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Infinite loop (CVE-ID: CVE-2024-52532)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when reading WebSocket data. A remote attacker can trick the victim into visiting a specially crafted website, consume all available system resources and cause denial of service conditions.


2) Buffer overflow (CVE-ID: CVE-2024-52531)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when performing conversion to UTF-8. A remote attacker can trigger memory corruption and crash the application.


3) Buffer Over-read (CVE-ID: CVE-2025-32053)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the sniff_feed_or_html() and skip_insignificant_space() functions when parsing server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.


4) Buffer Over-read (CVE-ID: CVE-2025-32052)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the sniff_unknown() function when handling server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.

5) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2025-32051)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the soup_uri_decode_data_uri() function when processing a malformed URI. A remote attacker can trick the victim into clicking on a specially crafted link and crash the application.


6) Buffer Over-read (CVE-ID: CVE-2025-32050)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the append_param_quoted() function when handling server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.

Remediation

Install update from vendor's website.

References