The version of libsoup installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4476 advisory.

  - A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be     triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically     crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to     a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious     HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious     server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client     application into connecting to the attacker's malicious server. (CVE-2025-4476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be     triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically     crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to     a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious     HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious     server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client     application into connecting to the attacker's malicious server.(CVE-2025-4476)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1233 advisory.

    A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be     triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically     crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to     a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious     HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious     server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client     application into connecting to the attacker's malicious server. (CVE-2025-4476)

    A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the     termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted     multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries     (out-of-bounds read). (CVE-2025-4969)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01817-1 advisory.

    - CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423)
    - CVE-2025-4948: Fixed integer underflow in soup_multipart_new_from_message() leading to denial of service     (bsc#1243332)
    - CVE-2025-4476: Fixed NULL pointer dereference may lead to denial of service (bsc#1243422)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1f41505af2 advisory.

    This update fixes these CVEs:
      CVE-2025-4948       CVE-2025-32908       CVE-2025-32907       CVE-2025-4969       CVE-2025-4945       CVE-2025-4476


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
241911	CBL Mariner 2.0 Security Update: libsoup (CVE-2025-4476)	Nessus	MarinerOS Local Security Checks	2025/7/11	2026/2/24	medium
261890	EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2025-2015)	Nessus	Huawei Local Security Checks	2025/9/10	2026/2/24	medium
264859	EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2025-2136)	Nessus	Huawei Local Security Checks	2025/9/16	2026/2/24	medium
271780	Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-1233)	Nessus	Amazon Linux Local Security Checks	2025/10/28	2026/2/24	medium
237888	SUSE SLES15 Security Update : libsoup (SUSE-SU-2025:01817-1)	Nessus	SuSE Local Security Checks	2025/6/6	2026/2/24	medium
244369	Fedora 41 : libsoup3 (2025-1f41505af2)	Nessus	Fedora Local Security Checks	2025/8/6	2026/2/24	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium