CVE-2025-40907
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
概要
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library.
The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-40907 libfcgi-perl 修正版: 0.79+ds-2
参照URL
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch patch-diff.githubusercontent.com
- report github.com
- report github.com
- web cpan.org
- web openwall.com
- web synacktiv.com