RLSA-2025:8292

Source
https://errata.rockylinux.org/RLSA-2025:8292
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2025:8292.json
JSON Data
https://api.test.osv.dev/v1/vulns/RLSA-2025:8292
Upstream
Published
2025-07-29T13:38:41.630147Z
Modified
2025-07-29T14:03:16.123034Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Important: mingw-freetype and spice-client-win security update
Details

MinGW Windows Freetype library.

Security Fix(es):

  • freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files (CVE-2025-27363)

  • libsoup: Integer overflow in appendparamquoted (CVE-2025-32050)

  • libsoup: Heap buffer overflow in sniff_unknown() (CVE-2025-32052)

  • libsoup: Heap buffer overflows in snifffeedorhtml() and skipinsignificant_space() (CVE-2025-32053)

  • libsoup: Out of bounds reads in soupheadersparse_request() (CVE-2025-32906)

  • libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907)

  • libsoup: NULL Pointer Dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c (CVE-2025-32909)

  • libsoup: Null pointer deference on libsoup via /auth/soup-auth-digest.c through "soupauthdigest_authenticate" on client when server omits the "realm" parameter in an Unauthorized response with Digest authentication (CVE-2025-32910)

  • libsoup: Double free on soupmessageheadersgetcontent_disposition() through "soup-message-headers.c" via "params" GHashTable value (CVE-2025-32911)

  • libsoup: NULL pointer dereference in soupmessageheadersgetcontent_disposition when "filename" parameter is present, but has no value in Content-Disposition header (CVE-2025-32913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8 / mingw-freetype

Package

Name
mingw-freetype
Purl
pkg:rpm/rocky-linux/mingw-freetype?distro=rocky-linux-8-x86-64&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:2.8-3.el8_10.1

Rocky Linux:8 / spice-client-win

Package

Name
spice-client-win
Purl
pkg:rpm/rocky-linux/spice-client-win?distro=rocky-linux-8-x86-64&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:8.10-1.el8_10