Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2025-4945

Libsoup: integer overflow in cookie expiration date handling in libsoup

LOW 3.7

At a glance

Source
NVD
EPSS
EPSS 0.70 % · percentile 53 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Deferred

Description

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

Weaknesses (CWE)

  • CWE-190 — Integer Overflow or Wraparound

References

Scores

VersionScoreVectorScored by
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Nredhat
CVSS 3.1LOW 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NNVD · secalert@redhat.com (Secondary)

European references

Affected products

ProductVersions
libsoupaffected 0 ≤ 3.6.5
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.6.5-3.el10_0.9 < *
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.6.5-3.el10_1.6 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:2.62.2-9.el7_9 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.62.3-10.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:2.62.3-10.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:2.62.3-1.el8_2.6 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_4.6 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:2.62.3-2.el8_4.6 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_6.6 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 0:2.62.3-2.el8_6.6 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 0:2.62.3-2.el8_6.6 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 0:2.62.3-3.el8_8.6 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.72.0-10.el9_6.3 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.72.0-12.el9_7.1 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:2.72.0-8.el9_0.6 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.72.0-8.el9_2.6 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:2.72.0-8.el9_4.6 < *
Red Hat · Red Hat Enterprise Linux 6

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD