The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3140 advisory.

  - The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers     to cause a denial of service (infinite recursion) via a crafted PDF file, as demonstrated by pdftops.
    (CVE-2017-18267)

  - There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps     through 0.3.0. A crafted input will lead to a remote denial of service attack. (CVE-2018-10733)

  - There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of     gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a     g_input_stream_read call. A crafted input will lead to a remote denial of service attack. (CVE-2018-10767)

  - There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu     package for Poppler 0.24.5. A crafted input will lead to a remote denial of service attack. Later Ubuntu     packages such as for Poppler 0.41.0 are not affected. (CVE-2018-10768)

  - The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname. (CVE-2018-12910)

  - Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that     is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and     denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
    (CVE-2018-13988)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 2.68.0 and fix FTBFS

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libsoup packages installed that are affected by a vulnerability:

  - An out-of-bounds read has been discovered in libsoup     when getting cookies from a URI with empty hostname. An     attacker may use this flaw to cause a crash in the     application. (CVE-2018-12910)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libsoup package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The get_cookies function in soup-cookie-jar.c in     libsoup 2.63.2 allows attackers to have unspecified     impact via an empty hostname.(CVE-2018-12910)

  - A stack-based buffer overflow flaw was discovered     within the HTTP processing of libsoup. A remote     attacker could exploit this flaw to cause a crash or,     potentially, execute arbitrary code by sending a     specially crafted HTTP request to a server using the     libsoup HTTP server functionality or by tricking a user     into connecting to a malicious HTTP server with an     application using the libsoup HTTP client     functionality.(CVE-2017-2885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Crash in soup_cookie_jar.c:get_cookies() on empty     hostnames (CVE-2018-12910)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libsoup package has been released.

This update for libsoup fixes the following issues :

Security issue fixed :

CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).

CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).

Bug fixes: bsc#1086036: translation-update-upstream commented out for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update backports an upstream fix for CVE-2018-12910.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on     empty hostnames (CVE-2018-12910)

  - poppler: Infinite recursion in     fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function     allows denial of service (CVE-2017-18267)

  - libgxps: heap based buffer over read in     ft_font_face_hash function of gxps-fonts.c     (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in     gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in     Annot.h:AnnotPath::getCoordsLength() allows for denial     of service via crafted PDF (CVE-2018-10768)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

Additional Changes :

  - PackageKit is now aware of our SL7 minor release upgrade     tool.

An update is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

GNOME is the default desktop environment of Red Hat Enterprise Linux.

Security Fix(es) :

* libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

* poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service (CVE-2017-18267)

* libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

* libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c (CVE-2018-10767)

* poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF (CVE-2018-10768)

* poppler: out of bounds read in pdfunite (CVE-2018-13988)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein Askari for reporting CVE-2018-13988.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory.

  - freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to crash     (CVE-2015-9381)

  - freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment,     psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

  - gdk-pixbuf2: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function (CVE-2017-2862)

  - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service     (CVE-2017-18267)

  - webkitgtk: memory corruption processing maliciously crafted web content (CVE-2018-4121, CVE-2018-4200,     CVE-2018-4204)

  - libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

  - libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

  - poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via     crafted PDF (CVE-2018-10768)

  - webkitgtk: Improper TLS certificate verification for WebSocket connections (CVE-2018-11712)

  - webkitgtk: WebSockets don't use system proxy settings (CVE-2018-11713)

  - libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

  - poppler: out of bounds read in pdfunite (CVE-2018-13988)

  - accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c     (CVE-2018-14036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libsoup fixes the following issues :

Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916).

Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for libsoup fixes the following issues: Security issue fixed :

  - CVE-2018-12910: Fix crash when handling empty hostnames     (bsc#1100097).

  - CVE-2017-2885: Fix chunk decoding buffer overrun that     could be exploited against either clients or servers     (bsc#1052916). Bug fixes :

  - bsc#1086036: translation-update-upstream commented out     for Leap

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Soup HTTP library performed insuffient validation of cookie requests which could result in an out-of-bounds memory read.

For Debian 8 'Jessie', these problems have been fixed in version 2.48.0-1+deb8u2.

We recommend that you upgrade your libsoup2.4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Soup HTTP library performed insufficient validation of cookie requests which could result in an out-of-bounds memory read.

It was discovered that libsoup incorrectly handled certain cookie requests. An attacker could possibly use this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198871	RHEL 6 : libsoup (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
181106	Oracle Linux 7 : GNOME (ELSA-2018-3140)	Nessus	Oracle Linux Local Security Checks	critical
140995	EulerOS Virtualization for ARM 64 3.0.6.0 : libsoup (EulerOS-SA-2020-2047)	Nessus	Huawei Local Security Checks	critical
129640	Fedora 31 : mingw-libsoup (2019-addb1d273c)	Nessus	Fedora Local Security Checks	critical
127231	NewStart CGSL CORE 5.04 / MAIN 5.04 : libsoup Vulnerability (NS-SA-2019-0048)	Nessus	NewStart CGSL Local Security Checks	critical
124895	EulerOS Virtualization for ARM 64 3.0.1.0 : libsoup (EulerOS-SA-2019-1392)	Nessus	Huawei Local Security Checks	critical
124579	openSUSE Security Update : libsoup (openSUSE-2019-1310)	Nessus	SuSE Local Security Checks	critical
123617	EulerOS 2.0 SP5 : libsoup (EulerOS-SA-2019-1143)	Nessus	Huawei Local Security Checks	critical
121993	Photon OS 2.0: Libsoup PHSA-2018-2.0-0091	Nessus	PhotonOS Local Security Checks	critical
121887	Photon OS 1.0: Libsoup PHSA-2018-1.0-0182	Nessus	PhotonOS Local Security Checks	critical
121042	SUSE SLES12 Security Update : libsoup (SUSE-SU-2018:2204-2)	Nessus	SuSE Local Security Checks	critical
120932	Fedora 28 : libsoup (2018-fb2afee474)	Nessus	Fedora Local Security Checks	critical
119908	EulerOS 2.0 SP2 : libsoup (EulerOS-SA-2018-1419)	Nessus	Huawei Local Security Checks	critical
119519	EulerOS 2.0 SP3 : libsoup (EulerOS-SA-2018-1391)	Nessus	Huawei Local Security Checks	critical
119177	Scientific Linux Security Update : GNOME on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
118995	CentOS 7 : PackageKit / accountsservice / adwaita-icon-theme / appstream-data / at-spi2-atk / etc (CESA-2018:3140)	Nessus	CentOS Local Security Checks	critical
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical
111637	openSUSE Security Update : libsoup (openSUSE-2018-856)	Nessus	SuSE Local Security Checks	critical
111574	SUSE SLED12 / SLES12 Security Update : libsoup (SUSE-SU-2018:2204-1)	Nessus	SuSE Local Security Checks	critical
110946	Debian DLA-1416-1 : libsoup2.4 security update	Nessus	Debian Local Security Checks	critical
110933	Fedora 27 : libsoup (2018-c3838931e1)	Nessus	Fedora Local Security Checks	critical
110929	Debian DSA-4241-1 : libsoup2.4 - security update	Nessus	Debian Local Security Checks	critical
110923	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libsoup vulnerability (USN-3701-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2018-12910

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical