Logo
›
›vulnerability›CVE-2024-52531
Name
CVE-2024-52531
Source
NVD ( link)Debian ( link)
Description
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response).
CWEs
CWE-787
Published Date
Updated Date
Workaround
-
Advisories
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407Issue Tracking
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407#note_2316401Issue Tracking
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/homeVendor Advisory
https://offsec.almond.consulting/using-aflplusplus-on-bug-bounty-programs-an-example-with-gnome-libsoup.htmlExploit

Analysis#

Affected Component
Analysis
libsoup
Patched

Vulnerability Ratings#

6.5
CVSSv31
8.4
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libsoup
buildroot
master
2.74.3
Patched
libsoup3
openwrt
master
3.7.1-r2
Not Affected
libsoup3
openwrt
openwrt-25.12
3.6.5-r1
Not Affected
libsoup
yocto
kirkstone
3.0.7
Patched
libsoup
yocto
master
3.6.6
Not Affected
libsoup
yocto
scarthgap
3.4.4
Exploitable

Resolved with patches#

libsoup (buildroot:2025.02.x)

#
Title
Author
Resolve
1
headers: Be more robust against invalid input when
Changqing Li <changqing.li@windriver.com>
CVE-2024-52531

libsoup (buildroot:master)

#
Title
Author
Resolve
1
headers: Be more robust against invalid input when
Changqing Li <changqing.li@windriver.com>
CVE-2024-52531

libsoup (yocto:kirkstone)

#
Title
Author
Resolve
1
fuzzing: Cover soup_header_parse_param_list
Patrick Griffis <pgriffis@igalia.com>
CVE-2024-52531
2
headers: Be more robust against invalid input when parsing
Patrick Griffis <pgriffis@igalia.com>
CVE-2024-52531
3
tests: Add test for passing invalid UTF-8 to
Patrick Griffis <pgriffis@igalia.com>
CVE-2024-52531