SB20250529114 - Red Hat Enterprise Linux 10 update for libsoup3
Published: May 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2025-32049)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in SoupWebsocketConnection. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Resource exhaustion (CVE-ID: CVE-2025-32907)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Information disclosure (CVE-ID: CVE-2025-4035)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an error when handling cookies, as libsoup clients mistakenly allow cookies to be set for public suffix
domains if the domain contains at least two components and includes an
uppercase character. A remote attacker can set cookies for the domain they do not have access to and perform session fixation attacks.
4) Integer underflow (CVE-ID: CVE-2025-4948)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer underflow within the soup_multipart_new_from_message() function when handling multipart messages. A remote attacker can trick the victim into visiting a specially crafted website, trigger an integer underflow and crash the application.
Remediation
Install update from vendor's website.