ALT-BU-2025-6133-1
Branch sisyphus_riscv64 update bulletin.
Package cinnamon updated to version 6.4.9-alt1 for branch sisyphus_riscv64.
Closed bugs
Ошибка при открытии окна настроек мыши
Package rasdaemon updated to version 0.8.3-alt2 for branch sisyphus_riscv64.
Closed bugs
rasdaemon.env: No such file or directory
Package libsoup updated to version 2.74.3-alt2 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2025-00232
Уязвимость функции soup_header_parse_param_list_strict() библиотеки libsoup графического интерфейса GNOME, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-04853
Уязвимость функции append_param_quoted() библиотеки libsoup графического интерфейса GNOME, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-12
CVE-2024-52530
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header.
Modified: 2025-04-14
CVE-2024-52531
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response).
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407
- https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407#note_2316401
- https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home
- https://offsec.almond.consulting/using-aflplusplus-on-bug-bounty-programs-an-example-with-gnome-libsoup.html
- https://offsec.almond.consulting/using-aflplusplus-on-bug-bounty-programs-an-example-with-gnome-libsoup.html
Modified: 2024-11-12
CVE-2024-52532
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients.
Modified: 2025-06-04
CVE-2025-2784
A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.
- RHSA-2025:7505
- RHSA-2025:8126
- RHSA-2025:8132
- RHSA-2025:8139
- RHSA-2025:8140
- RHSA-2025:8252
- RHSA-2025:8480
- RHSA-2025:8481
- RHSA-2025:8482
- https://access.redhat.com/security/cve/CVE-2025-2784
- RHBZ#2354669
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/422
- https://gitlab.gnome.org/GNOME/libsoup/-/issues/422
Modified: 2025-05-29
CVE-2025-32050
A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.
Modified: 2025-05-29
CVE-2025-32052
A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.
Modified: 2025-05-29
CVE-2025-32053
A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.