GNOME CVE-2025-4945
LOWCVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.
AnalysisAI
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software.
Technical ContextAI
An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum (or minimum) size of the integer type used to store it. This vulnerability is classified as Integer Overflow or Wraparound (CWE-190).
Affected ProductsAI
Affected: GNOME applications and other software
RemediationAI
Use safe integer arithmetic libraries. Check for overflow conditions before operations. Use appropriately sized integer types.
Share
External POC / Exploit Code
Leaving vuln.today