[ubuntu/jammy-security] libsoup2.4 2.74.2-3ubuntu0.3 (Accepted)

[Hlib Korzhynskyy]

libsoup2.4 (2.74.2-3ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Out of bound read.
    - debian/patches/CVE-2025-32906-*.patch: Add out of bound checks in
      soup_headers_parse_request in ./libsoup/soup-headers.c.
    - debian/patches/CVE-2025-32914.patch: Replace strstr operation with
      g_strstr_len in ./libsoup/soup-multipart.c.
    - CVE-2025-32906
    - CVE-2025-32914
  * SECURITY UPDATE: Null pointer dereference.
    - debian/patches/CVE-2025-32909.patch: Add resource size check in
      ./libsoup/soup-content-sniffer.c.
    - debian/patches/CVE-2025-32910-32912-*.patch: Add checks for missing realm
      and nonce, and fix memory leak in ./libsoup/soup-auth-digest.c.
    - debian/patches/CVE-2025-32912.patch: Add additional checks for nonce in
      ./libsoup/soup-auth-digest.c.
    - CVE-2025-32909
    - CVE-2025-32910
    - CVE-2025-32912
  * SECURITY UPDATE: Memory corruption.
    - debian/patches/CVE-2025-32911-32913-*.patch: Add checks for empty
      filename in ./libsoup/soup-message-headers.c.
    - CVE-2025-32911
    - CVE-2025-32913
  * SECURITY UPDATE: Memory leak.
    - debian/patches/CVE-2025-46420.patch: Free allocated strings during
      iteration in ./libsoup/soup-headers.c.
    - CVE-2025-46420
  * SECURITY UPDATE: Information exposure through host impersonation.
    - debian/patches/CVE-2025-46421.patch: Strip credentials on cross-origin
      redirects in ./libsoup/soup-session.c.
    - CVE-2025-46421
  * debian/patches/Extend-test-cert-to-2049.patch: Extend expiration to 2049 of
    a certificate used for build tests.

Date: 2025-05-05 14:22:27.494852+00:00
Changed-By: Hlib Korzhynskyy <hlib.korzhynskyy at canonical.com>
https://launchpad.net/ubuntu/+source/libsoup2.4/2.74.2-3ubuntu0.3
-------------- next part --------------
Sorry, changesfile not available.