Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

SUSE: 2024:4365-1 important: libsoup update addresses critical threats

suse
Calendar Grey December 17, 2024
Dist Suse Esm H88
Emergency libsoup security notice highlights various vulnerabilities. Update your systems promptly to enhance security.
* bsc#1233285 * bsc#1233287 * bsc#1233292 Cross-References:

Summary

## This update for libsoup fixes the following issues: * CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names (bsc#1233285) * CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (bsc#1233292) * CVE-2024-52532: Fixed infinite loop while reading websocket data (bsc#1233287) Other fixes: \- websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391). \- fix an intermittent test failure (glgo#GNOME/soup#399). \- updated to version 2.68.4. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP2 LTSS

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE infinite loop libsoup HTTP request smuggling

References

* bsc#1233285

* bsc#1233287

* bsc#1233292

Cross-

* CVE-2024-52530

* CVE-2024-52531

* CVE-2024-52532

CVSS scores:

* CVE-2024-52530 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

* CVE-2024-52530 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2024-52530 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2024-52531 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

* CVE-2024-52531 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2024-52531 ( NVD ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-52532 ( SUSE ): 7.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:4365-1
Release Date: 2024-12-17T15:58:34Z
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE infinite loop libsoup HTTP request smuggling

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here