RHSA-2025:8292HighCVSS 9.0

Red Hat Security Advisory: mingw-freetype and spice-client-win security update

Published
May 29, 2025
Last Modified
November 5, 2026

🔗 CVE IDs covered (10)

CVE-2025-32050 →CVE-2025-32053 →CVE-2025-32906 →CVE-2025-32909 →CVE-2025-32910 →CVE-2025-32911 →CVE-2025-27363 →CVE-2025-32052 →CVE-2025-32907 →CVE-2025-32913 →

📋 Description

CVE-2025-27363 — freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-32050 — libsoup: Integer overflow in append_param_quoted CVE-2025-32052 — libsoup: Heap buffer overflow in sniff_unknown() CVE-2025-32053 — libsoup: Heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() CVE-2025-32906 — libsoup: Out of bounds reads in soup_headers_parse_request() CVE-2025-32907 — libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header CVE-2025-32909 — libsoup: NULL Pointer Dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c CVE-2025-32910 — libsoup: Null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an Unauthorized response with Digest authentication CVE-2025-32911 — libsoup: Double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" GHashTable value CVE-2025-32913 — libsoup: NULL pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in Content-Disposition header

🎯 Affected products12

  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux CRB (v. 8)
  • mingw-freetype-0:2.8-3.el8_10.1.src as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw32-freetype-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw32-freetype-debuginfo-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw32-freetype-static-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw64-freetype-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw64-freetype-debuginfo-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • mingw64-freetype-static-0:2.8-3.el8_10.1.noarch as a component of Red Hat Enterprise Linux CRB (v. 8)
  • spice-client-win-0:8.10-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • spice-client-win-x64-0:8.10-1.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • spice-client-win-x86-0:8.10-1.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: By restricting the sources from which font files can be loaded allowing only fonts from trusted sources, as well as validating the input for font files to avoid malformed font structures or any data which could trigger the vulnerability would reduce the risk and mitigate this vulnerability until the fix is provided. Workaround: No mitigation is currently available for this vulnerability. Workaround: Currently, no mitigation was found for this vulnerability. Workaround: Currently, no mitigation is available for this vulnerability.

🔗 References (13)