Component - poco

Name

poco

Version

1.12.5p2

Type

library

Description

Modern, powerful open source cross-platform C++ class libraries

Licenses

BSL-1.0

PURL

CPE

cpe:2.3:*:pocoproject:poco:1.12.5p2:*:*:*:*:*:*:*

Other Versions#

Project

Branch

Version

yocto

kirkstone

1.11.2

yocto

master

1.15.3

Patches#

Title

Author

Resolve

Use std::atomic<int> instead of std::atomic<bool>

Khem Raj <raj.khem@gmail.com>

cppignore.lnx: Ignore PKCS12 and testLaunch test

Khem Raj <raj.khem@gmail.com>

fix(Net): A SEGV at Net/src/MultipartReader.cpp:164:1 #4915

=?UTF-8?q?G=C3=BCnter=20Obiltschnig?= <guenter.obiltschnig@appinf.com>

CVE-2025-6375

fix(build): Install cmake files with resolved ENABLE_JSON and

tyler92 <tyler92@inbox.ru>

Vulnerabilities#

Name

Analysis

Description

CVE-2025-6375

Patched

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.