Security Fix(es) :

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on     empty hostnames (CVE-2018-12910)

  - poppler: Infinite recursion in     fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function     allows denial of service (CVE-2017-18267)

  - libgxps: heap based buffer over read in     ft_font_face_hash function of gxps-fonts.c     (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in     gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in     Annot.h:AnnotPath::getCoordsLength() allows for denial     of service via crafted PDF (CVE-2018-10768)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

Additional Changes :

  - PackageKit is now aware of our SL7 minor release upgrade     tool.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916).

Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update backports an upstream fix for CVE-2018-12910.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Soup HTTP library performed insuffient validation of cookie requests which could result in an out-of-bounds memory read.

For Debian 8 'Jessie', these problems have been fixed in version 2.48.0-1+deb8u2.

We recommend that you upgrade your libsoup2.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libsoup package has been released.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.68.0 and fix FTBFS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname. (CVE-2018-12910)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
119177	Scientific Linux Security Update : GNOME on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	11/27/2018	7/19/2024	critical
111637	openSUSE Security Update : libsoup (openSUSE-2018-856)	Nessus	SuSE Local Security Checks	8/10/2018	8/22/2024	critical
110933	Fedora 27 : libsoup (2018-c3838931e1)	Nessus	Fedora Local Security Checks	7/6/2018	9/6/2024	critical
110946	Debian DLA-1416-1 : libsoup2.4 security update	Nessus	Debian Local Security Checks	7/9/2018	9/6/2024	critical
121993	Photon OS 2.0: Libsoup PHSA-2018-2.0-0091	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	critical
124579	openSUSE Security Update : libsoup (openSUSE-2019-1310)	Nessus	SuSE Local Security Checks	5/3/2019	5/29/2024	critical
140995	EulerOS Virtualization for ARM 64 3.0.6.0 : libsoup (EulerOS-SA-2020-2047)	Nessus	Huawei Local Security Checks	9/29/2020	2/16/2024	critical
129640	Fedora 31 : mingw-libsoup (2019-addb1d273c)	Nessus	Fedora Local Security Checks	10/7/2019	4/19/2024	critical
221952	Linux Distros Unpatched Vulnerability : CVE-2018-12910	Nessus	Misc.	3/4/2025	9/3/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical