An update of the libsoup package has been released.

According to the version of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Crash in soup_cookie_jar.c:get_cookies() on empty     hostnames (CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.68.0 and fix FTBFS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname. (CVE-2018-12910)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for libsoup fixes the following issues :

Security issue fixed :

CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).

CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).

Bug fixes: bsc#1086036: translation-update-upstream commented out for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0076 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2018-12910:
      An out-of-bounds read has been discovered in libsoup when getting cookies from a URI with empty     hostname. An attacker may use this flaw to cause a crash in the application.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libsoup fixes the following issues: Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916). Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GNOME is the default desktop environment of Red Hat Enterprise Linux.

Security Fix(es) :

* libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

* poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service (CVE-2017-18267)

* libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

* libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c (CVE-2018-10767)

* poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF (CVE-2018-10768)

* poppler: out of bounds read in pdfunite (CVE-2018-13988)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein Askari for reporting CVE-2018-13988.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

This update backports an upstream fix for CVE-2018-12910.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3140 advisory.

    - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty     hostnames
    - Security fix for CVE-2018-15120
    - Fix crash when Object has negative number (CVE-2018-13988)
    - Fix infinite recursion on malformed documents (CVE-2017-18267)
    - Fix crash inn AnnotInk::draw() (CVE-2018-10768)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916).

Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
121993	Photon OS 2.0: Libsoup PHSA-2018-2.0-0091	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	critical
123617	EulerOS 2.0 SP5 : libsoup (EulerOS-SA-2019-1143)	Nessus	Huawei Local Security Checks	2019/4/2	2024/6/6	critical
129640	Fedora 31 : mingw-libsoup (2019-addb1d273c)	Nessus	Fedora Local Security Checks	2019/10/7	2024/4/19	critical
221952	Linux Distros Unpatched Vulnerability : CVE-2018-12910	Nessus	Misc.	2025/3/4	2025/9/3	critical
121042	SUSE SLES12 Security Update : libsoup (SUSE-SU-2018:2204-2)	Nessus	SuSE Local Security Checks	2019/1/9	2024/6/27	critical
124895	EulerOS Virtualization for ARM 64 3.0.1.0 : libsoup (EulerOS-SA-2019-1392)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
239750	TencentOS Server 3: libsoup (TSSA-2023:0076)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
111574	SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2018:2204-1)	Nessus	SuSE Local Security Checks	2018/8/7	2024/8/23	critical
140995	EulerOS Virtualization for ARM 64 3.0.6.0 : libsoup (EulerOS-SA-2020-2047)	Nessus	Huawei Local Security Checks	2020/9/29	2024/2/16	critical
118995	CentOS 7 : PackageKit / accountsservice / adwaita-icon-theme / appstream-data / at-spi2-atk / etc (CESA-2018:3140)	Nessus	CentOS Local Security Checks	2018/11/16	2020/8/3	critical
119519	EulerOS 2.0 SP3 : libsoup (EulerOS-SA-2018-1391)	Nessus	Huawei Local Security Checks	2018/12/10	2024/7/16	critical
120932	Fedora 28 : libsoup (2018-fb2afee474)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical
181106	Oracle Linux 7 : GNOME (ELSA-2018-3140)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
111637	openSUSE Security Update : libsoup (openSUSE-2018-856)	Nessus	SuSE Local Security Checks	2018/8/10	2024/8/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical