UBUNTU-CVE-2025-23016: Buffer Overflow
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.0-8.3ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.0-10ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.0-10ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.2-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.2-2.1ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/libfcgito a version that resolves this vulnerability.Fixed in 2.4.5-0.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector is local and requires no privileges or user interaction. Exploitation involves sending crafted nameLen or valueLen values in data to the IPC socket.
Which versions are affected?
FastCGI fcgi2 (fcgi) versions 2.x through 2.4.4 are affected.