← CVE Intelligence

CVE-2025-4945

Libsoup: integer overflow in cookie expiration date handling in libsoup PUBLISHED

Description (CNA)

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

Affected (CNA)

Vendor / productVersions
Not supplied / Not suppliedaffected 0 through 3.6.5
Red Hat / Red Hat Enterprise Linux 10unaffected 0:3.6.5-3.el10_0.9 before *
Red Hat / Red Hat Enterprise Linux 10unaffected 0:3.6.5-3.el10_1.6 before *
Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:2.62.2-9.el7_9 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:2.62.3-10.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:2.62.3-10.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:2.62.3-1.el8_2.6 before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_4.6 before *
Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:2.62.3-2.el8_4.6 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:2.62.3-2.el8_6.6 before *
Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 0:2.62.3-2.el8_6.6 before *
Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 0:2.62.3-2.el8_6.6 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 0:2.62.3-3.el8_8.6 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.72.0-10.el9_6.3 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:2.72.0-12.el9_7.1 before *
Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:2.72.0-8.el9_0.6 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.72.0-8.el9_2.6 before *
Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:2.72.0-8.el9_4.6 before *
Red Hat / Red Hat Enterprise Linux 6unknown

CWE

CWE-190

References

ADP enrichment

CISA-ADP

No English description supplied.