-------------------------------------------------------------------------
Debian LTS Advisory DLA-3992-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sean Whitton
December 12, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : libsoup2.4
Version : 2.72.0-2+deb11u1
CVE ID : CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
Debian Bug : 1088812 1089238 1089240
Multiple vulnerabilities were discovered in libsoup2.4, an HTTP library
for Gtk+ programs.
CVE-2024-52530
In some configurations, HTTP request smuggling is possible because
null characters at the end of the names of HTTP headers were
ignored.
CVE-2024-52531
There was a buffer overflow in applications that perform conversion
to UTF-8 in soup_header_parse_param_list_strict. This could lead to
memory corruption, crashes or information disclosure.
(Contrary to the CVE description, it is now believed that input
received over the network could trigger this.)
CVE-2024-52532
An infinite loop in the processing of WebSocket data from clients
could lead to a denial-of-service problem through memory exhaustion.
For Debian 11 bullseye, these problems have been fixed in version
2.72.0-2+deb11u1.
We recommend that you upgrade your libsoup2.4 packages.
For the detailed security status of libsoup2.4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libsoup2.4
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature