PT-2025-12685 · Gnome+1 · Gnome Libgsf+1

Ninpwn · Published 2025-03-24 · Updated 2025-12-30 · CVE-2025-2722

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNOME libgsf versions up to 1.14.53

Description A critical issue affects the function gsf prop settings collect va due to the manipulation of the argument n alloced params, leading to a heap-based buffer overflow. This issue requires local access to exploit. The vendor was contacted about this disclosure but did not respond.

Recommendations For GNOME libgsf versions up to 1.14.53, consider restricting access to the gsf prop settings collect va function until a patch is available. As a temporary workaround, avoid manipulating the n alloced params argument to minimize the risk of exploitation.

Fix

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-119

Related Identifiers

CVE-2025-2722

Affected Products

Debian

Gnome Libgsf

References · 15

• https://osv.dev/vulnerability/CVE-2025-2722 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2722 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2722 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2722 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2722 · Security Note
• https://t.me/cvedetector/21015 · Telegram Post
• https://vuldb.com/?ctiid.300742 · Note
• https://gnome.org · Note
• https://vuldb.com/?submit.520182 · Note
• https://vuldb.com/?id.300742 · Note
• https://twitter.com/CVEnew/status/2006132893131706655 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1904158263458828585 · Twitter Post
• https://t.me/cvenotify/116009 · Telegram Post
• https://t.me/cvetracker/19817 · Telegram Post