USN-7490-3: libsoup vulnerabilities
USN-7490-1 fixed vulnerabilities in libsoup2.4. This update provides the corresponding updates for libsoup3. Original advisory details: Tan Wei Chong discovered that libsoup incorrectly handled memory when parsing HTTP request headers. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service. (CVE-2025-32906) Alon Zahavi discovered that libsoup incorrectly parsed video files. An attacker could possibly use this issue to send a maliciously crafted HTTP response back to the client, causing a denial of service, or leading to undefined behavior. (CVE-2025-32909) Jan Różański discovered that libsoup incorrectly handled memory when parsing authentication headers. An attacker could possibly use this issue to send a maliciously crafted HTTP response back to the client, causing a denial of service. (CVE-2025-32910, CVE-2025-32912) It was discovered that libsoup incorrectly handled data in the hash table data type. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or remote code execution. (CVE-2025-32911) Jan Różański discovered that libsoup incorrectly handled memory when parsing the content disposition HTTP header. An attacker could possibly use this issue to send maliciously crafted data to a client or server, causing a denial of service. (CVE-2025-32913) Alon Zahavi discovered that libsoup incorrectly handled memory when parsing HTTP requests. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service or obtaining sensitive information. (CVE-2025-32914) It was discovered that libsoup incorrectly handled memory when parsing quality-list headers. An attacker could possibly use this issue to send a maliciously crafted HTTP request to the server, causing a denial of service. (CVE-2025-46420) Jan Różański discovered that libsoup did not strip authorization information upon redirects. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-46421)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7490-3?
The severity of USN-7490-3 is high due to potential vulnerabilities in libsoup that could allow attackers to exploit the HTTP request header parsing.
How do I fix USN-7490-3?
To fix USN-7490-3, update libsoup to version 3.6.0-2ubuntu0.3 or later for Ubuntu 24.10, 3.4.4-5ubuntu0.3 or later for Ubuntu 24.04, or 3.0.7-0ubuntu1+esm3 or later for Ubuntu 22.04.
Which versions of libsoup are affected by USN-7490-3?
Versions of libsoup below 3.6.0-2ubuntu0.3 for Ubuntu 24.10, 3.4.4-5ubuntu0.3 for Ubuntu 24.04, and 3.0.7-0ubuntu1+esm3 for Ubuntu 22.04 are affected by USN-7490-3.
What type of vulnerability is detailed in USN-7490-3?
USN-7490-3 details a memory handling vulnerability in libsoup that occurs during the parsing of HTTP request headers.
Is USN-7490-3 specific to a particular Linux distribution?
Yes, USN-7490-3 is specific to Ubuntu and affects various versions of the libsoup package in that distribution.