The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8126 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-8132 advisory.

    [2.62.3-9]
    - Add patches to improve test reliability
    - Backport patches for various CVEs       Resolves: RHEL-85879       Resolves: RHEL-92280       Resolves: RHEL-93031       Resolves: RHEL-93032

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:8132 advisory.

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)
      * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
      * libsoup: OOB Read on libsoup through function soup_multipart_new_from_message in soup-multipart.c     leads to crash or exit of process (CVE-2025-32914)
      * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in     libsoup (CVE-2025-4948)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8482 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01794-1 advisory.

    - CVE-2025-4948: Fixed integer underflow in soup_multipart_new_from_message() leading to denial of service     (bsc#1243332)
    - CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423)
    - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
    - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
    - CVE-2025-32910: Fixed null pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
    - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'.
    (bsc#1241238)
    - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
    - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01801-1 advisory.

    - CVE-2025-4948: Fixed integer underflow in soup_multipart_new_from_message() leading to denial of service     (bsc#1243332)
    - CVE-2025-4969: Fixed off-by-one out-of-bounds read may lead to infoleak (bsc#1243423)
    - CVE-2025-32906: Fixed out of bounds reads in soup_headers_parse_request() (bsc#1241263)
    - CVE-2025-32909: Fixed NULL pointer dereference in the sniff_mp4 function in soup-content-sniffer.c     (bsc#1241226)
    - CVE-2025-32910: Fixed null pointer deference on client when server omits the realm parameter in an     Unauthorized response with Digest authentication (bsc#1241252)
    - CVE-2025-32911: Fixed double free on soup_message_headers_get_content_disposition() via 'params'.
    (bsc#1241238)
    - CVE-2025-32912: Fixed NULL pointer dereference in SoupAuthDigest (bsc#1241214)
    - CVE-2025-32913: Fixed NULL pointer dereference in soup_message_headers_get_content_disposition     (bsc#1241162)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c04e5b95f1 advisory.

    Backport fixes for CVE-2025-4476, CVE-2025-4948, CVE-2025-4969, CVE-2025-46420, CVE-2025-46421,     CVE-2025-4945

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug     resulting in a buffer under-read.(CVE-2025-32050)

    A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the     sniff_mp4 function. The HTTP server may cause the libsoup client to crash.(CVE-2025-32909)

    A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be     triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically     crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to     a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious     HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious     server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client     application into connecting to the attacker's malicious server.(CVE-2025-4476)

    A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list()     function when parsing a quality list that contains elements with all zeroes.(CVE-2025-46420)

    A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the     HTTP Authorization header to the new host that the redirection points to. This allows the new host to     impersonate the user to the original host that issued the redirect.(CVE-2025-46421)

    A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is     commonly used by GNOME and other applications to handle web communications. The issue occurs when the     library processes specially crafted multipart messages. Due to improper validation, an internal     calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid     memory and crash. As a result, any application or server using libsoup could be forced to exit     unexpectedly, creating a denial-of-service (DoS) risk.(CVE-2025-4948)

    A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the     termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted     multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries     (out-of-bounds read).(CVE-2025-4969)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-99768b0fab advisory.

    This update fixes these CVEs:
      CVE-2025-4948       CVE-2025-32908       CVE-2025-32907       CVE-2025-4969       CVE-2025-4945       CVE-2025-4476


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237240	RHEL 9 : libsoup (RHSA-2025:8126)	Nessus	Red Hat Local Security Checks	2025/5/26	2026/2/24	medium
237258	Oracle Linux 8 : libsoup (ELSA-2025-8132)	Nessus	Oracle Linux Local Security Checks	2025/5/26	2026/2/24	medium
237261	AlmaLinux 8 : libsoup (ALSA-2025:8132)	Nessus	Alma Linux Local Security Checks	2025/5/26	2026/2/24	high
237736	RHEL 8 : libsoup (RHSA-2025:8482)	Nessus	Red Hat Local Security Checks	2025/6/4	2026/2/24	medium
237697	SUSE SLES12 Security Update : libsoup (SUSE-SU-2025:01794-1)	Nessus	SuSE Local Security Checks	2025/6/3	2026/2/24	medium
237789	SUSE SLES15 Security Update : libsoup (SUSE-SU-2025:01801-1)	Nessus	SuSE Local Security Checks	2025/6/5	2026/2/24	medium
237944	Fedora 42 : mingw-libsoup (2025-c04e5b95f1)	Nessus	Fedora Local Security Checks	2025/6/8	2026/2/24	medium
249203	EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2025-1960)	Nessus	Huawei Local Security Checks	2025/8/13	2026/2/24	medium
243317	Fedora 42 : libsoup3 (2025-99768b0fab)	Nessus	Fedora Local Security Checks	2025/8/4	2026/2/24	medium

检测

插件搜索

medium

medium

high

medium

medium

medium

medium

medium

medium