SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4105-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4105-1 advisory. This update for libsoup fixes the following issue: - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncatio...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Changes for libsoup2: tld-test: update after changes in the public suffix list: ".bd" is no longer in the public suffix list so let's use ".jm"...

libsoup-3_0-0-3.6.6-8.1 on GA media (moderate)

libsoup-30-0-3.6.6-8.1 on GA media Announcement ID: openSUSE-SU-2026:11596-1 Rating: moderate Cross-References: CVE-2026-12548 CVSS scores: CVE-2026-12548 SUSE : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2026-12548 SUSE : 6.3...

CVE-2026-12548 Libsoup: heap out-of-bounds read in libsoup due to integer truncation

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

VulnCheck KEV: CVE-2025-12548

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration SSH keys, tokens, etc. from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333...

CVE-2025-12548

creationtimestamp| type| source ---|---|--- 2026-01-13 18:13:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcd5t7r76g2f 2026-01-13 18:14:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcd5v4dvbv2v 2026-01-14 14:33:11+00:00| seen|...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.23.1 Release.

Red Hat OpenShift Dev Spaces 3.23.1 has been released. This release addresses CVE-2025-12548 'Eclipse Che — unauthenticated RCE and secret exfiltration via TCP/3333'...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.24.1 Release.

Red Hat OpenShift Dev Spaces 3.24.1 has been released. This release addresses CVE-2025-12548 'Eclipse Che — unauthenticated RCE and secret exfiltration via TCP/3333'...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.22.1 Release.

Red Hat OpenShift Dev Spaces 3.22.1 has been released. This release addresses CVE-2025-12548 'Eclipse Che — unauthenticated RCE and secret exfiltration via TCP/3333'...

CVE-2025-12548

No description is available for this CVE. Mitigation Apply the security best practices from the Red Hat OpenShift Dev Spaces Administration Guide: https://docs.redhat.com/en/documentation/redhatopenshiftdevspaces/3.24/html/administrationguide/security-best-practices...

Eclipse Che machine-exec Unauthenticated RCE

This module exploits an unauthenticated remote code execution vulnerability in the Eclipse Che machine-exec service CVE-2025-12548. The machine-exec service, exposed on port 3333 within Red Hat OpenShift DevSpaces developer workspace containers, accepts WebSocket connections without authenticatio...

CVE-2024-12548

Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability i...

CVE-2024-12548 Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability

Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability i...

CVE-2024-12548 Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability

Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability i...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2024-12548)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12548 advisory. 4.14.35-2047.538.5.1 - net/mlx5e: drop shorter ethernet frames Manjunath Patil Orabug: 36660755 Tenable has extracted the preceding description block...

CVE-2020-12548

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

CVE-2019-12548

Bludit before 3.9.0 is vulnerable to remote code execution by an authenticated user who uploads a PHP file while changing the site logo via /admin/ajax/upload-logo. Root cause: an upload path/permission issue allows execution of injected PHP. A fix is available in Bludit 3.9.0 (as referenced by r...

CVE-2018-12548

In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code...