Описание
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/resolute | released | 2.74.3-10.1ubuntu5+esm4 |
| esm-infra-legacy/xenial | released | 2.52.2-1ubuntu0.3+esm9 |
| esm-infra/bionic | released | 2.62.1-1ubuntu0.4+esm10 |
| esm-infra/focal | released | 2.70.0-1ubuntu0.5+esm5 |
| jammy | released | 2.74.2-3ubuntu0.10 |
| noble | released | 2.74.3-6ubuntu1.10 |
| resolute | needed | |
| stonking | needs-triage | |
| upstream | needed |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/jammy | released | 3.0.7-0ubuntu1+esm10 |
| jammy | needed | |
| noble | released | 3.4.4-5ubuntu0.10 |
| resolute | released | 3.6.6-1ubuntu0.2 |
| stonking | released | 3.6.6-1ubuntu3.1 |
| upstream | not-affected | 3.7.3 |
Показывать по
EPSS
8.2 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
A flaw was found in libsoup. The soup_uri_decode_data_uri() function i ...
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
EPSS
8.2 High
CVSS3