The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0889 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (CVE-2024-52531)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:0903 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (CVE-2024-52531)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1075 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (CVE-2024-52531)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:1047 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict (CVE-2024-52531)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at     the end of header names are ignored, i.e., a 'Transfer-Encoding\0: chunked' header is treated the same as     a 'Transfer-Encoding: chunked' header.(CVE-2024-52530)

    GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain     patterns of WebSocket data from clients.(CVE-2024-52532)

    GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in     soup_header_parse_param_list_strict. Input received over the network cannot trigger this.(CVE-2024-52531)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1047 advisory.

    - Fixed CVE-2024-52531 buffer overflow via UTF-8 conversion in

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in     soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via     soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a     request or response). (CVE-2024-52531)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7127-1 advisory.

    It was discovered that libsoup ignored certain characters at the end of header names. A remote attacker     could possibly use this issue to perform a HTTP request smuggling attack. This issue only affected Ubuntu     22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-52530)

    It was discovered that libsoup did not correctly handle memory while performing UTF-8 conversions. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2024-52531)

    It was discovered that libsoup could enter an infinite loop when reading certain websocket data. An     attacker could possibly use this issue to cause a denial of service. (CVE-2024-52532)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7126-1 advisory.

    It was discovered that libsoup ignored certain characters at the end of header names. A remote attacker     could possibly use this issue to perform a HTTP request smuggling attack. (CVE-2024-52530)

    It was discovered that libsoup did not correctly handle memory while performing UTF-8 conversions. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2024-52531)

    It was discovered that libsoup could enter an infinite loop when reading certain websocket data. An     attacker could possibly use this issue to cause a denial of service. (CVE-2024-52532)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3992 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3992-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     December 12, 2024                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libsoup2.4     Version        : 2.72.0-2+deb11u1     CVE ID         : CVE-2024-52530 CVE-2024-52531 CVE-2024-52532     Debian Bug     : 1088812 1089238 1089240

    Multiple vulnerabilities were discovered in libsoup2.4, an HTTP library     for Gtk+ programs.

    CVE-2024-52530

        In some configurations, HTTP request smuggling is possible because         null characters at the end of the names of HTTP headers were         ignored.

    CVE-2024-52531

        There was a buffer overflow in applications that perform conversion         to UTF-8 in soup_header_parse_param_list_strict.  This could lead to         memory corruption, crashes or information disclosure.
        (Contrary to the CVE description, it is now believed that input         received over the network could trigger this.)

    CVE-2024-52532

        An infinite loop in the processing of WebSocket data from clients         could lead to a denial-of-service problem through memory exhaustion.

    For Debian 11 bullseye, these problems have been fixed in version     2.72.0-2+deb11u1.

    We recommend that you upgrade your libsoup2.4 packages.

    For the detailed security status of libsoup2.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libsoup2.4

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 3.6.1 之前的 GNOME libsoup 中對於在 soup_header_parse_param_list_strict 中執行 UTF-8 轉換的應用程式允許緩衝區溢位。有一種合理的方法可透過 soup_message_headers_get_content_type 從遠端取得此內容 (例如應用程式可能想要擷取要求或回應的內容類型)。 (CVE-2024-52531)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2025:0838 公告中提及的一個弱點影響。

    Libsoup 套件為 GNOME 提供 HTTP 用戶端和伺服器程式庫。

    安全性修正：

    * libsoup：透過 soup_header_parse_param_list_strict 中的 UTF-8 轉換造成的緩衝區溢位弱點 (CVE-2024-52531)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2025:0889 公告中提及的弱點影響。

    Libsoup 套件為 GNOME 提供 HTTP 用戶端和伺服器程式庫。

    安全性修正:

    * libsoup：透過 soup_header_parse_param_list_strict 中的 UTF-8 轉換造成的緩衝區溢位弱點 (CVE-2024-52531)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2025:0903 公告中提及的一個弱點影響。

    Libsoup 套件為 GNOME 提供 HTTP 用戶端和伺服器程式庫。

    安全性修正:

    * libsoup：透過 soup_header_parse_param_list_strict 中的 UTF-8 轉換造成的緩衝區溢位弱點 (CVE-2024-52531)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2025:1075 公告中提及的弱點影響。

    Libsoup 套件為 GNOME 提供 HTTP 用戶端和伺服器程式庫。

    安全性修正:

    * libsoup：透過 soup_header_parse_param_list_strict 中的 UTF-8 轉換造成的緩衝區溢位弱點 (CVE-2024-52531)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2025:1047 公告中提及的弱點影響。

    Libsoup 套件為 GNOME 提供 HTTP 用戶端和伺服器程式庫。

    安全性修正:

    * libsoup：透過 soup_header_parse_param_list_strict 中的 UTF-8 轉換造成的緩衝區溢位弱點 (CVE-2024-52531)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 7 主機上安裝的套件受到 ELSA-2025-1047 公告中提及的一個弱點影響。

    - 已修復 CVE-2024-52531 中透過 UTF-8 轉換造成的緩衝區溢位弱點

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 22.04 LTS/24.04 LTS/24.10 主機上安裝的套件受到 USN-7127-1 公告中所提及的多個弱點影響。

    據發現，libsoup 會忽略標頭名稱結尾的特定字元。遠端攻擊者可能利用此問題，發動 HTTP 要求走私攻擊。此問題僅影響 Ubuntu 22.04 LTS 和 Ubuntu 24.04 LTS。(CVE-2024-52530)

    據發現，libsoup 在執行 UTF-8 轉換時，未正確處理記憶體。攻擊者可能會利用此問題造成拒絕服務或執行任意程式碼。
    (CVE-2024-52531)

    據發現，讀取特定 websocket 資料時，libsoup 可進入無限迴圈。攻擊者可能利用此問題造成拒絕服務。(CVE-2024-52532)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 18.04 LTS/20.04 LTS/22.04 LTS/24.04 LTS/24.10 主機上安裝的多個套件受到 USN-7126-1 公告中提及的多個弱點影響。

    據發現，libsoup 會忽略標頭名稱結尾的特定字元。遠端攻擊者可能利用此問題，發動 HTTP 要求走私攻擊。(CVE-2024-52530)

    據發現，libsoup 在執行 UTF-8 轉換時，未正確處理記憶體。攻擊者可能會利用此問題造成拒絕服務或執行任意程式碼。
    (CVE-2024-52531)

    據發現，讀取特定 websocket 資料時，libsoup 可進入無限迴圈。攻擊者可能利用此問題造成拒絕服務。(CVE-2024-52532)

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
214915	RHEL 8 : libsoup (RHSA-2025:0889)	Nessus	Red Hat Local Security Checks	2025/2/3	2025/9/5	high
214918	RHEL 8 : libsoup (RHSA-2025:0903)	Nessus	Red Hat Local Security Checks	2025/2/3	2025/9/5	high
215081	RHEL 8 : libsoup (RHSA-2025:1075)	Nessus	Red Hat Local Security Checks	2025/2/7	2025/9/5	high
215090	RHEL 7 : libsoup (RHSA-2025:1047)	Nessus	Red Hat Local Security Checks	2025/2/7	2025/9/5	high
215983	EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2025-1160)	Nessus	Huawei Local Security Checks	2025/2/10	2025/9/5	high
216603	Oracle Linux 7 : libsoup (ELSA-2025-1047)	Nessus	Oracle Linux Local Security Checks	2025/2/21	2025/9/11	high
231026	Linux Distros Unpatched Vulnerability : CVE-2024-52531	Nessus	Misc.	2025/3/6	2025/9/7	high
211895	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : libsoup3 vulnerabilities (USN-7127-1)	Nessus	Ubuntu Local Security Checks	2024/11/27	2025/9/5	high
211896	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : libsoup vulnerabilities (USN-7126-1)	Nessus	Ubuntu Local Security Checks	2024/11/27	2025/9/5	high
212690	Debian dla-3992 : gir1.2-soup-2.4 - security update	Nessus	Debian Local Security Checks	2024/12/12	2025/9/5	high
231026	Linux Distros 未修補的弱點：CVE-2024-52531	Nessus	Misc.	2025/3/6	2025/9/7	high
214810	RHEL 8：libsoup (RHSA-2025:0838)	Nessus	Red Hat Local Security Checks	2025/1/30	2025/9/5	high
214915	RHEL 8: libsoup (RHSA-2025:0889)	Nessus	Red Hat Local Security Checks	2025/2/3	2025/9/5	high
214918	RHEL 8: libsoup (RHSA-2025:0903)	Nessus	Red Hat Local Security Checks	2025/2/3	2025/9/5	high
215081	RHEL 8：libsoup (RHSA-2025:1075)	Nessus	Red Hat Local Security Checks	2025/2/7	2025/9/5	high
215090	RHEL 7：libsoup (RHSA-2025:1047)	Nessus	Red Hat Local Security Checks	2025/2/7	2025/9/5	high
216603	Oracle Linux 7：libsoup (ELSA-2025-1047)	Nessus	Oracle Linux Local Security Checks	2025/2/21	2025/9/11	high
211895	Ubuntu 22.04 LTS / 24.04 LTS / 24.10：libsoup3 弱點 (USN-7127-1)	Nessus	Ubuntu Local Security Checks	2024/11/27	2025/9/5	high
211896	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10：libsoup 弱點 (USN-7126-1)	Nessus	Ubuntu Local Security Checks	2024/11/27	2025/9/5	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high