CVE-2025-6375

Name	CVE-2025-6375
Description	A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1108157

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
poco (PTS)	bullseye	1.10.0-6+deb11u1	vulnerable
	bullseye (security)	1.10.0-6+deb11u2	vulnerable
	bookworm	1.11.0-3+deb12u1	vulnerable
	trixie, sid	1.13.0-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
poco	source	(unstable)	(unfixed)			1108157

Notes

https://github.com/pocoproject/poco/issues/4915
https://github.com/pocoproject/poco/commit/6f2f85913c191ab9ddfb8fae781f5d66afccf3bf (poco-1.14.2-release)