SB2025052980 - openEuler update for libsoup

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Buffer Over-read (CVE-ID: CVE-2025-2784)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the skip_insignificant_whitespace() function when reading server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read 1 byte out of bounds.

2) Buffer Over-read (CVE-ID: CVE-2025-32050)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the append_param_quoted() function when handling server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.

3) Buffer Over-read (CVE-ID: CVE-2025-32052)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the sniff_unknown() function when handling server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.

4) Buffer Over-read (CVE-ID: CVE-2025-32053)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error within the sniff_feed_or_html() and skip_insignificant_space() functions when parsing server HTTP response. A remote attacker can trick the victim into visiting a specially crafted website and read parts of the heap memory.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1441