Debian alert DLA-4398-1 (libsoup2.4)

From:
             
 
Andreas Henriksson <andreas@fatal.se>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4398-1] libsoup2.4 security update
Date:
             
 
Tue, 09 Dec 2025 19:00:19 +0100
Message-ID:
             
 
<g25shu7qe4c4nk75flln57y7gksfkvl4hchprm6uzozrdmtiik@hozjfe2o26kz>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4398-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Andreas Henriksson
December 09, 2025                             https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : libsoup2.4
Version        : 2.72.0-2+deb11u3
CVE ID         : CVE-2025-4476 CVE-2025-4945 CVE-2025-4948 CVE-2025-4969
Debian Bug     : 1106325 1106337 1106375 1107757

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the
glib main loop, to integrate well with GNOME applications.

CVE-2025-4476

    A denial-of-service vulnerability has been identified in the libsoup
    HTTP client library. This flaw can be triggered when a libsoup client
    receives a 401 (Unauthorized) HTTP response containing a specifically
    crafted domain parameter within the WWW-Authenticate header. Processing
    this malformed header can lead to a crash of the client application
    using libsoup. An attacker could exploit this by setting up a malicious
    HTTP server. If a user's application using the vulnerable libsoup
    library connects to this malicious server, it could result in a
    denial-of-service. Successful exploitation requires tricking a user's
    client application into connecting to the attacker's malicious server.

CVE-2025-4945

    A flaw was found in the cookie parsing logic of the libsoup HTTP
    library, used in GNOME applications and other software. The
    vulnerability arises when processing the expiration date of cookies,
    where a specially crafted value can trigger an integer overflow. This
    may result in undefined behavior, allowing an attacker to bypass cookie
    expiration logic, causing persistent or unintended cookie behavior. The
    issue stems from improper validation of large integer inputs during date
    arithmetic operations within the cookie parsing routines.

CVE-2025-4948

    A flaw was found in the soup_multipart_new_from_message() function of
    the libsoup HTTP library, which is commonly used by GNOME and other
    applications to handle web communications. The issue occurs when the
    library processes specially crafted multipart messages. Due to improper
    validation, an internal calculation can go wrong, leading to an integer
    underflow. This can cause the program to access invalid memory and
    crash. As a result, any application or server using libsoup could be
    forced to exit unexpectedly, creating a denial-of-service (DoS) risk.

CVE-2025-4969

    A vulnerability was found in the libsoup package. This flaw stems from
    its failure to correctly verify the termination of multipart HTTP
    messages. This can allow a remote attacker to send a specially crafted
    multipart HTTP body, causing the libsoup-consuming server to read beyond
    its allocated memory boundaries (out-of-bounds read).

For Debian 11 bullseye, these problems have been fixed in version
2.72.0-2+deb11u3.

We recommend that you upgrade your libsoup2.4 packages.

For the detailed security status of libsoup2.4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libsoup2.4

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmk4Y7AACgkQC8R9xk0T
Uwb7+BAAknwAkmCSKQPVVanVE2sZIDCHe9ajzIWsgSc3aVdvyyfY05proQjtt4gJ
9c0FT/GDScqsbMuz2oaSkSwLO3pwngDS4SfB84IyIpZjEg5K2qao/Y2zx1CWyq5C
nt3ADy7d9QdbEI+jeNUNyXw86JqGgOa1EE4uEhGsSgKMmXWPE+UPP3k0XaJsTg3E
KYqrPRi1vmlRf8S/Tt2D8pdZ5T2qHWQrbwO7KTdfmO/nepMZIxZ41ZNI31XWtd9X
9BGz9MDbF1k7VSfMucGxq5OeInWRUChWIa6xyL47ksR5DnwpyR2pkErv5gioh8C5
Q/7n9IlhmqRYNgF4tWYnad8ytPPSV5lbp59dtzYElTOxpJYZHHvhQLXYJ1neftg1
hmVFCcBiDXD3Yh7/DKYHOhtGRdce40atLZtWs/JBmEeuhZXoo2ACwvXP8VDR3PjI
B07nO7fgZAzy/wnpRlXTP7th3tBr1Vhri4uV4obTDKsOq+Ts76uM0q3s9kAaWX5C
D2n+nA6PlL9lIkmb4XVKKFICInjpUnHXNvLFPNgRjPfzAFhUqAz1qOgbYn/Xb1jL
LTKaDMSFq5KrxfjNlO87+9vap178ieIutSpx6NZuiZx/3VtobvUS091CGaICQkZg
eXko6265XFFExEucgv8o/OdhoEiJMOgBxIaVv5a7b23QYpxTw/k=
=+J1b
-----END PGP SIGNATURE-----