PT-2025-25663 · Libgepub+2 · Libgepub+2

Mhzcyber + 1 · Publicado 2025-06-17 · Atualizado 2025-09-30 · CVE-2025-6196

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libgepub (affected versions not specified)

Description A flaw in libgepub causes the software to mishandle file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This results in the application crashing. The issue may affect applications that use libgepub to parse user-supplied EPUB content, potentially leading to a denial of service. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2025-12601

CVE-2025-6196

SUSE-SU-2025:02213-1

SUSE-SU-2025:02222-1

Produtos afetados

Debian

Red Os

Libgepub

Referências · 23

• 🔥 https://gitlab.gnome.org/GNOME/libgepub/-/issues/18 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:02222-1 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1934984673446506958 · Publicação no Twitter
• https://t.me/cveNotify/131792 · Publicação no Telegram
• https://twitter.com/Cezar_H_Linux/status/1941257758495604867 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-libgepub-cve-2025-6196 · Nota
• https://access.redhat.com/security/cve/CVE-2025-6196 · Nota
• https://bdu.fstec.ru/vul/2025-12601 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2025:02213-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2025-6196 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2025/suse-su-202502222-1 · Nota
• https://suse.com/security/cve/CVE-2025-6196 · Nota
• https://bugzilla.suse.com/1244704 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-6196 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-6196 · Aviso do Fabricante