CVE-2025-2723

NameCVE-2025-2723
DescriptionA vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libgsf (PTS)bullseye1.14.47-1undetermined
bullseye (security)1.14.47-1+deb11u1undetermined
bookworm, bookworm (security)1.14.50-1+deb12u1undetermined
sid, trixie1.14.53-1undetermined

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libgsfsource(unstable)undetermined

Notes

https://vuldb.com/?submit.520183

Search for package or bug name: Reporting problems