The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3383-1 advisory.

    Aleksandar Nikolic discovered a stack based buffer overflow when handling chunked encoding. An attacker     could use this to cause a denial of service or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New libsoup packages are available for Slackware 14.1, 14.2, and
-current to fix a security issue.

Security fix for CVE-2017-2885 (stack based buffer overflow with HTTP Chunked Encoding).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916).

Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

This update was imported from the SUSE:SLE-12-SP2:Update update project.

An update of the libsoup package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2459 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a     user into connecting to a malicious HTTP server with an application using the libsoup HTTP client     functionality. (CVE-2017-2885)

    Red Hat would like to thank Aleksandar Nikolic (Cisco Talos) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libsoup fixes the following issues :

  - A bug in the HTTP Chunked Encoding code has been fixed     that could have been exploited by attackers to cause a     stack-based buffer overflow in client or server code     running libsoup (bsc#1052916, CVE-2017-2885).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsoup fixes the following issues :

  - A bug in the HTTP Chunked Encoding code has been fixed     that could have been exploited by attackers to cause a     stack-based buffer overflow in client or server code     running libsoup (bsc#1052916, CVE-2017-2885).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

An update for libsoup is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es) :

* A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality. (CVE-2017-2885)

Red Hat would like to thank Aleksandar Nikolic (Cisco Talos) for reporting this issue.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2459 advisory.

    [2.56.0-4]
    - Fix chunked decoding buffer overrun (CVE-2017-2885) (rh #1479322)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A stack-based buffer overflow flaw was discovered within     the HTTP processing of libsoup. A remote attacker could     exploit this flaw to cause a crash or, potentially,     execute arbitrary code by sending a specially crafted     HTTP request to a server using the libsoup HTTP server     functionality or by tricking a user into connecting to a     malicious HTTP server with an application using the     libsoup HTTP client functionality. (CVE-2017-2885)

According to the version of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality. (CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsoup fixes the following issues :

Security issue fixed :

CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).

CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).

Bug fixes: bsc#1086036: translation-update-upstream commented out for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2107:01 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part     of a SOAP (Simple Object Access Protocol) implementation called Soup, but     the SOAP and non-SOAP parts have now been split into separate packages.
    libsoup uses the Glib main loop and is designed to work well with GTK     applications. This enables GNOME applications to access HTTP servers     on the network in a completely asynchronous fashion, very similar to     the Gtk  programming model (a synchronous operation mode is also     supported for those who want it).
    CVE-2017-2885
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102417	Ubuntu 14.04 LTS / 16.04 LTS : libsoup vulnerability (USN-3383-1)	Nessus	Ubuntu Local Security Checks	2017/8/11	2024/8/27	critical
102433	Slackware 14.1 / 14.2 / current : libsoup (SSA:2017-223-02)	Nessus	Slackware Local Security Checks	2017/8/14	2025/12/2	critical
102460	Fedora 26 : libsoup (2017-b0ec173bd1)	Nessus	Fedora Local Security Checks	2017/8/14	2025/12/2	critical
111637	openSUSE Security Update : libsoup (openSUSE-2018-856)	Nessus	SuSE Local Security Checks	2018/8/10	2024/8/22	critical
121847	Photon OS 1.0: Libsoup PHSA-2018-1.0-0149	Nessus	PhotonOS Local Security Checks	2019/2/7	2021/2/9	critical
102412	RHEL 7 : libsoup (RHSA-2017:2459)	Nessus	Red Hat Local Security Checks	2017/8/11	2025/12/2	critical
102413	SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2017:2129-1)	Nessus	SuSE Local Security Checks	2017/8/11	2025/12/2	critical
102468	openSUSE Security Update : libsoup (openSUSE-2017-914)	Nessus	SuSE Local Security Checks	2017/8/14	2025/12/2	critical
102764	CentOS 7 : libsoup (CESA-2017:2459)	Nessus	CentOS Local Security Checks	2017/8/25	2025/11/25	critical
102409	Oracle Linux 7 : libsoup (ELSA-2017-2459)	Nessus	Oracle Linux Local Security Checks	2017/8/11	2025/12/2	critical
102631	Fedora 26 : mingw-libsoup (2017-1f4c82d73e)	Nessus	Fedora Local Security Checks	2017/8/22	2025/11/26	critical
102670	Scientific Linux Security Update : libsoup on SL7.x x86_64 (20170815)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	critical
103067	EulerOS 2.0 SP1 : libsoup (EulerOS-SA-2017-1209)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	critical
121042	SUSE SLES12 Security Update : libsoup (SUSE-SU-2018:2204-2)	Nessus	SuSE Local Security Checks	2019/1/9	2024/6/27	critical
124895	EulerOS Virtualization for ARM 64 3.0.1.0 : libsoup (EulerOS-SA-2019-1392)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
289628	MiracleLinux 7 : libsoup-2.56.0-4.el7 (AXSA:2017-2107:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical