Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:03445-1

Опубликовано: 01 окт. 2025
Источник: suse-cvrf

Описание

Security update for snpguest

This update for snpguest fixes the following issues:

  • CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243869).
  • CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value is passed to the properties argument (bsc#1242601).

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15 SP6
snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6
snpguest-0.3.2-150600.3.6.1

Ссылки

Описание

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP6:snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6:snpguest-0.3.2-150600.3.6.1
Ссылки

Описание

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP6:snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6:snpguest-0.3.2-150600.3.6.1
Ссылки