ALT-PU-2022-3170-1

Package update libsoup in branch c9f2

Version2.66.2-alt1.c9f2.1

Published2022-11-18

Max severityCRITICAL

Severity:

Closed issues (2)

CRITICAL9.8

Уязвимость функции soup_ntlm_parse_challenge() библиотеки libsoup, позволяющая нарушителю оказать воздействие на целостность, конфиденциальность и доступность защищаемой информации

Published: 2020-04-06Modified: 2022-12-28

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2019-17266

CRITICAL9.8

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.

Published: 2019-10-06Modified: 2024-11-21

CVSS 2.0HIGH 7.5

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References