Libsoup Heap Buffer Over-Read Vulnerability in Content Sniffer

A heap buffer over-read vulnerability has been identified in the Libsoup HTTP library, specifically in versions prior to 3.6.5. The issue arises in the content sniffer's skip_insignificant_whitespace() function, where Libsoup clients can inadvertently read one byte out-of-bounds. This vulnerability can be triggered by a crafted HTTP response from an HTTP server.

Impact

Exploitation of this vulnerability leads to a heap buffer over-read, allowing for out-of-bounds memory access.

Remediation

Users can apply the available update for Libsoup. Instructions for applying this update can be found on the Red Hat Customer Portal.