Описание
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/resolute | released | 2.74.3-10.1ubuntu5+esm4 |
| esm-infra-legacy/xenial | not-affected | code not present |
| esm-infra/bionic | released | 2.62.1-1ubuntu0.4+esm10 |
| esm-infra/focal | released | 2.70.0-1ubuntu0.5+esm5 |
| jammy | released | 2.74.2-3ubuntu0.10 |
| noble | released | 2.74.3-6ubuntu1.10 |
| resolute | needed | |
| stonking | needs-triage | |
| upstream | needed |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/jammy | released | 3.0.7-0ubuntu1+esm10 |
| jammy | needed | |
| noble | released | 3.4.4-5ubuntu0.10 |
| resolute | released | 3.6.6-1ubuntu0.2 |
| stonking | released | 3.6.6-1ubuntu3.1 |
| upstream | not-affected | 3.7.3 |
Показывать по
EPSS
8.6 High
CVSS3
Связанные уязвимости
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong ...
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.
EPSS
8.6 High
CVSS3