CVE-2009-0585
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x,...
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
- Record
CVE-2009-0585- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
- Record
CVE-2009-0585- Updated
- 2026-11-02
EUVDEUVD-2009-0588 No score
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
- Record
EUVD-2009-0588- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw8f-f7xx-crfw No score
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x,...
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
- Record
GHSA-fw8f-f7xx-crfw- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0585 No score
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
- Record
DEBIAN-CVE-2009-0585- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libsoupDebian:14 |
before 2.2.105-4, plus listed versions 2.1.2-12.1.5-12.1.7-12.2.100-12.2.101-1 Show 26 moreShow less2.2.102-12.2.103-12.2.104-12.2.105-12.2.105-22.2.105-32.2.2-12.2.3-12.2.3-22.2.3-2sarge12.2.6-12.2.7-12.2.7-22.2.91-12.2.91-22.2.92-12.2.93-12.2.93-22.2.93-32.2.95.1-12.2.96-12.2.97-12.2.98-12.2.98-22.2.98-2+etch12.2.99-1 |
2.2.105-4 |
libsoupDebian:4.0 |
before 2.2.98-2+etch1, plus listed versions 2.2.98-2 |
2.2.98-2+etch1 |
evolution28-libsoupRed Hat:enterprise_linux:4::as |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-develRed Hat:enterprise_linux:4::as |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
libsoupRed Hat:enterprise_linux:4::as |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-develRed Hat:enterprise_linux:4::as |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
evolution28-libsoupRed Hat:enterprise_linux:4::desktop |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
evolution28-libsoup-develRed Hat:enterprise_linux:4::desktop |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
libsoupRed Hat:enterprise_linux:4::desktop |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-develRed Hat:enterprise_linux:4::desktop |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
evolution28-libsoupRed Hat:enterprise_linux:4::es |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-develRed Hat:enterprise_linux:4::es |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
libsoupRed Hat:enterprise_linux:4::es |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-develRed Hat:enterprise_linux:4::es |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
evolution28-libsoupRed Hat:enterprise_linux:4::ws |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
evolution28-libsoup-develRed Hat:enterprise_linux:4::ws |
before 0:2.2.98-5.el4.1 | 0:2.2.98-5.el4.1 |
libsoupRed Hat:enterprise_linux:4::ws |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoup-develRed Hat:enterprise_linux:4::ws |
before 0:2.2.1-4.el4.1 | 0:2.2.1-4.el4.1 |
libsoupRed Hat:enterprise_linux:5::client_workstation |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoup-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoup-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoupRed Hat:enterprise_linux:5::client |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoup-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoupRed Hat:enterprise_linux:5::server |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoup-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
libsoup-develRed Hat:enterprise_linux:5::server |
before 0:2.2.98-2.el5_3.1 | 0:2.2.98-2.el5_3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0585 is a high vulnerability (CVSS 7.5) in Joe Shaw Libsoup, published March 14, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.02%, the 90th percentile. Fixed in libsoup 2.2.105-4.
References
redhat.com/support/errata/RHSA-2009-0344.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9599
support.avaya.com/elmodocs2/security/ASA-2009-088.htm
mandriva.com/security/advisories?name=MDVSA-2009:081
openwall.com/lists/oss-security/2009/03/12/2
securityfocus.com/bid/34100
Show 20 moreShow less
secunia.com/advisories/35065
exchange.xforce.ibmcloud.com/vulnerabilities/49273
debian.org/security/2009/dsa-1748
lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
ocert.org/patches/2008-015/libsoup-CVE-2009-0585.diff
ubuntu.com/usn/USN-737-1
ocert.org/advisories/ocert-2008-015.html
nvd.nist.gov/vuln/detail/CVE-2009-0585
access.redhat.com/errata/RHSA-2009:0344
bugzilla.redhat.com/show_bug.cgi?id=488026
github.com/advisories/GHSA-fw8f-f7xx-crfw
security-tracker.debian.org/tracker/CVE-2009-0585
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0344.json
cve.org/CVERecord?id=CVE-2009-0585