CVE-2025-4945
LOWCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.
Analysis
A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software.
Technical Context
An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum (or minimum) size of the integer type used to store it. This vulnerability is classified as Integer Overflow or Wraparound (CWE-190).
Affected Products
Affected: GNOME applications and other software
Remediation
Use safe integer arithmetic libraries. Check for overflow conditions before operations. Use appropriately sized integer types.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today