9.8
CVSSv3

CVE-2018-12910

Published: 05/07/2018 Updated: 07/11/2023
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows malicious users to have unspecified impact via an empty hostname.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnome libsoup 2.63.2

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 17.10

canonical ubuntu linux 18.04

debian debian linux 8.0

debian debian linux 9.0

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

redhat openshift container platform 3.11

redhat ansible tower 3.3

opensuse leap 15.0

Vendor Advisories

libsoup could be made to crash if it received a specially crafted input ...
Synopsis Moderate: GNOME security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) ba ...
Synopsis Critical: Red Hat Ansible Tower 331-2 Release - Container Image Type/Severity Security Advisory: Critical Topic Security Advisory Description Red Hat Ansible Tower 331 is now available and contains the following bug fixes: Fixed event callback error when in-line vaulted variabl ...
It was discovered that the Soup HTTP library performed insufficient validation of cookie requests which could result in an out-of-bounds memory read For the stable distribution (stretch), this problem has been fixed in version 2560-2+deb9u2 We recommend that you upgrade your libsoup24 packages For the detailed security status of libsoup24 pl ...
An out-of-bounds read has been discovered in libsoup when getting cookies from a URI with empty hostname An attacker may use this flaw to cause a crash in the application ...