CVE-2025-23016
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values i...
Original description
The description as published by the source.
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-23016 libfcgi Fixed in: 2.4.2-2+deb11u1
References
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web openwall.com
- web github.com
- web lists.debian.org
- web synacktiv.com