{"id":"CVE-2017-2885","aliases":["ALPINE-CVE-2017-2885","DEBIAN-CVE-2017-2885","DSA-3929-1","EUVD-2017-12026","GHSA-qq4w-8g63-5r25","MGASA-2017-0272","RHSA-2017:2459","SUSE-SU-2017:2129-1","SUSE-SU-2017:2130-1","SUSE-SU-2018:2204-1","SUSE-SU-2018:2204-2","UBUNTU-CVE-2017-2885","USN-3383-1","openSUSE-SU-2024:10994-1"],"status":"published","title":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A...","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.23138,"percentile":0.97774,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2017-08-10T00:00:00Z","modified":"2026-10-24T10:30:39Z","fixes":[{"ecosystem":"Alpine:v3.3","package":"libsoup","fixed_in":["2.52.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"libsoup","fixed_in":["2.54.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libsoup","fixed_in":["2.56.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libsoup","fixed_in":["2.58.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libsoup","fixed_in":["2.58.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libsoup","fixed_in":["2.58.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsoup2.4","fixed_in":["2.56.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsoup2.4","fixed_in":["2.56.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libsoup2.4","fixed_in":["2.48.0-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"libsoup2.4","fixed_in":["2.56.0-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"libsoup","fixed_in":["2.48.1-1.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"libsoup","fixed_in":["2.58.2-1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup-debuginfo","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup-devel","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup-debuginfo","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup-devel","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup-debuginfo","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup-devel","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup-debuginfo","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup-devel","fixed_in":["0:2.56.0-4.el7_4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libsoup","fixed_in":["2.54.1-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"libsoup","fixed_in":["2.44.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libsoup","fixed_in":["2.44.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libsoup","fixed_in":["2.44.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libsoup","fixed_in":["2.44.2-2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libsoup","fixed_in":["2.44.2-2.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libsoup2.4","fixed_in":["2.44.2-1ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libsoup2.4","fixed_in":["2.52.2-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-1+deb8u1"}]}],"versions":["2.48.0-1"]},{"source":"osv","ecosystem":"Debian:9","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.0-2+deb9u1"}]}],"versions":["2.56.0-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.1-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.2-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libsoup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.56.0-4.el7_4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.1-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.2-5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-1ubuntu2.2"}]}],"versions":["2.42.2-6","2.44.1-1","2.44.2-1","2.44.2-1ubuntu1","2.44.2-1ubuntu2","2.44.2-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.2"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.2-1ubuntu2.2"}]}],"versions":["2.42.2-6","2.44.1-1","2.44.2-1","2.44.2-1ubuntu1","2.44.2-1ubuntu2","2.44.2-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsoup2.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52.2-1ubuntu0.2"}]}],"versions":["2.50.0-2debian1","2.52.1-1","2.52.2-1","2.52.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.0-2.5"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnome","product":"libsoup"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2459","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3929","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/100258","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Dec/3","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","article"]},{"url":"http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2885","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qq4w-8g63-5r25"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-2885","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2885","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0272.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21487","tags":["report"]},{"url":"https://www.talosintelligence.com/reports/TALOS-2017-0392/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479281","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2459.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2885","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172129-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1052916","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2885","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172130-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182204-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086036","tags":["report"]},{"url":"https://bugzilla.suse.com/1100097","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12910","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182204-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-2885","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3383-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5876","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-17T03:32:40.423Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-12026","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:00:00Z","modified":"2024-09-17T03:32:40Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:31.175316Z"}],"ghsa":[{"id":"GHSA-qq4w-8g63-5r25","title":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A...","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2022-05-13T01:01:16Z","modified":"2023-01-27T05:02:16Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:42:02.546908Z"}],"nvd":[{"id":"CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:02.783Z","modified":"2026-06-17T01:17:03.853Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"ALPINE-CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:02.783Z","modified":"2026-06-15T18:24:34.389277498Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:02.783Z","modified":"2026-10-24T10:30:39.601219055Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2018-04-24T19:29:02.783Z","modified":"2026-09-01T20:03:47.795077726Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"RHSA-2017:2459","title":"Red Hat Security Advisory: libsoup security update","status":"published","published":"2024-09-16T00:30:23Z","modified":"2026-07-01T10:02:46Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-2885","description":"An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.","status":"published","published":"2017-08-10T12:00:00Z","modified":"2026-04-22T11:24:00.54802Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DSA-3929-1","title":"libsoup2.4 - security update","status":"published","published":"2017-08-10T00:00:00Z","modified":"2026-03-09T01:22:15.902174Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0272","title":"Updated libsoup packages fix security vulnerability","description":"An exploitable stack based buffer overflow vulnerability exists in the\nGNOME libsoup 2.58. A specially crafted HTTP request can cause a stack\noverflow resulting in remote code execution. An attacker can send a\nspecial HTTP request to the vulnerable server to trigger this\nvulnerability (CVE-2017-2885).\n","status":"published","published":"2017-08-16T00:01:16Z","modified":"2026-04-16T06:24:33.966394051Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10994-1","title":"libsoup-2_4-1-2.72.0-2.5 on GA media","description":"These are all security issues fixed in the libsoup-2_4-1-2.72.0-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:43:03.051524Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:2129-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- A bug in the HTTP Chunked Encoding code has been fixed that could have been\n  exploited by attackers to cause a stack-based buffer overflow in client or\n  server code running libsoup (bsc#1052916, CVE-2017-2885).\n","status":"published","published":"2017-08-10T12:58:12Z","modified":"2026-02-04T03:27:53.063407Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2130-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\n- A bug in the HTTP Chunked Encoding code has been fixed that could have been\n  exploited by attackers to cause a stack-based buffer overflow in client or\n  server code running libsoup (bsc#1052916, CVE-2017-2885).\n","status":"published","published":"2017-08-10T12:56:52Z","modified":"2026-02-04T02:35:19.518444Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:2204-1","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).\n- CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).\n\nBug fixes:\n\n- bsc#1086036: translation-update-upstream commented out for Leap\n","status":"published","published":"2018-08-06T07:57:27Z","modified":"2026-02-04T03:05:49.718923Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2204-2","title":"Security update for libsoup","description":"This update for libsoup fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-12910: Fix crash when handling empty hostnames (bsc#1100097).\n- CVE-2017-2885: Fix chunk decoding buffer overrun that could be exploited against either clients or servers (bsc#1052916).\n\nBug fixes:\n\n- bsc#1086036: translation-update-upstream commented out for Leap\n","status":"published","published":"2019-01-08T08:36:26Z","modified":"2026-02-04T02:44:52.023807Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3383-1","title":"libsoup2.4 vulnerability","description":"Aleksandar Nikolic discovered a stack based buffer overflow when\nhandling chunked encoding. An attacker could use this to cause a\ndenial of service or possibly execute arbitrary code.\n","status":"published","published":"2017-08-10T17:06:05Z","modified":"2026-04-22T09:38:34.747594Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}