critique
CVE-2025-68114
capstone: Capstone: Memory corruption via unchecked vsnprintf return
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Photon OS. Plus basse selon AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée), Red Hat (moyenne), Amazon (moyenne), Azure Linux (moyenne).
Description
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit 2c7797182a1618be12017d7d41e0b6581d5d529e fixes the issue.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 4.0 | capstone, capstone-devel | 4.0.2-2.ph4 |
| Photon OS 5.0 | capstone, capstone-devel | 4.0.2-3.ph5 |
| alma 10 | capstone-java, python3-capstone | 5.0.1-7.el10_1 |
| alma 9 | capstone, capstone-devel, capstone-java et 1 autres | 4.0.2-11.el9_7 |
| alpine 3.23 | capstone | 5.0.7-r0 |
| alpine 3.24 | capstone | 5.0.7-r0 |
| alpine edge | capstone | 5.0.7-r0 |
| amazon linux 2 | capstone, capstone-debuginfo, capstone-devel et 2 autres | 3.0.5-1.amzn2.0.2 |
| amazon linux 2023 | capstone, capstone-debuginfo, capstone-debugsource et 4 autres | 4.0.2-9.amzn2023.0.5 |
| Azure Linux 3.0 | rust | 0:1.90.0-4.azl3 |
| debian 11 | capstone | pas de correctif indiqué |
| debian 12 | capstone | pas de correctif indiqué |
Afficher les 63 entrées de 30 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 4.0 | capstone | 4.0.2-2.ph4 |
| Photon OS 4.0 | capstone-devel | 4.0.2-2.ph4 |
| Photon OS 5.0 | capstone | 4.0.2-3.ph5 |
| Photon OS 5.0 | capstone-devel | 4.0.2-3.ph5 |
| alma 10 | capstone-java | 5.0.1-7.el10_1 |
| alma 10 | python3-capstone | 5.0.1-7.el10_1 |
| alma 9 | capstone | 4.0.2-11.el9_7 |
| alma 9 | capstone-devel | 4.0.2-11.el9_7 |
| alma 9 | capstone-java | 4.0.2-11.el9_7 |
| alma 9 | python3-capstone | 4.0.2-11.el9_7 |
| alpine 3.23 | capstone | 5.0.7-r0 |
| alpine 3.24 | capstone | 5.0.7-r0 |
| alpine edge | capstone | 5.0.7-r0 |
| amazon linux 2 | capstone | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-debuginfo | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-devel | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | capstone-java | 3.0.5-1.amzn2.0.2 |
| amazon linux 2 | python2-capstone | 3.0.5-1.amzn2.0.2 |
| amazon linux 2023 | capstone | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-debuginfo | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-debugsource | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-devel | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | capstone-java | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | python3-capstone | 4.0.2-9.amzn2023.0.5 |
| amazon linux 2023 | python3-capstone-debuginfo | 4.0.2-9.amzn2023.0.5 |
| Azure Linux 3.0 | rust | 0:1.90.0-4.azl3 |
| debian 11 | capstone | pas de correctif indiqué |
| debian 12 | capstone | pas de correctif indiqué |
| debian 13 | capstone | 5.0.7-1~deb13u1 |
| debian 14 | capstone | 5.0.7-1 |
| echo | capstone | 5.0.7-1~deb13u1 |
| Oracle Linux 9 | capstone | 4.0.2-11.el9_7 |
| Oracle Linux 9 | capstone-devel | 4.0.2-11.el9_7 |
| Oracle Linux 9 | capstone-java | 4.0.2-11.el9_7 |
| Oracle Linux 9 | python3-capstone | 4.0.2-11.el9_7 |
| rapidfort alma 9 | capstone | 4.0.2-13.el9_8 |
| rapidfort alpine 3.20 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.21 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.22 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.23 | capstone | 5.0.7-r0 |
| rapidfort alpine 3.24 | capstone | 5.0.7-r0 |
| rapidfort amazon linux 2023 | capstone | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | capstone-devel | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | capstone-java | 4.0.2-9.amzn2023.0.5 |
| rapidfort amazon linux 2023 | python3-capstone | 4.0.2-9.amzn2023.0.5 |
| rapidfort debian 12 | capstone | 0:5.0.7-1, 0:5.0.7-1~deb13u1 |
| rapidfort debian 13 | capstone | 0:5.0.7-1, 0:5.0.7-1~deb13u1 |
| rapidfort fedora 43 | capstone | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-devel | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-java | 5.0.5-8.fc43 |
| rapidfort fedora 43 | capstone-static | 5.0.5-8.fc43 |
| rapidfort fedora 43 | python3-capstone | 5.0.5-8.fc43 |
| rapidfort Oracle Linux 10 | capstone | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | capstone-devel | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | capstone-java | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 10 | python3-capstone | 0:5.0.1-7.el10_1 |
| rapidfort Oracle Linux 9 | capstone | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-devel | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-java | 0:4.0.2-11.el9_7 |
| rapidfort Oracle Linux 9 | capstone-static | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | python3-capstone | 0:4.0.2-11.el9_7 |
| rocky 10 | capstone | 5.0.1-7.el10_1 |
| rocky 9 | capstone | 4.0.2-11.el9_7 |
Références
- https://access.redhat.com/errata/RHSA-2026:4898
- https://access.redhat.com/security/cve/CVE-2025-68114
- https://bugzilla.redhat.com/2423416
- https://bugzilla.redhat.com/2423419
- https://bugzilla.redhat.com/show_bug.cgi?id=2423416
- https://bugzilla.redhat.com/show_bug.cgi?id=2423419
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67873
Les 17 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68114
- https://errata.almalinux.org/9/ALSA-2026-4898.html
- https://errata.rockylinux.org/RLSA-2026:4898
- https://github.com/capstone-engine/capstone/commit/2c7797182a1618be12017d7d41e0b6581d5d529e
- https://github.com/capstone-engine/capstone/security/advisories/GHSA-85f5-6xr3-q76r
- https://linux.oracle.com/cve/CVE-2025-68114.html
- https://linux.oracle.com/errata/ELSA-2026-6817.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-68114
- https://www.cve.org/CVERecord?id=CVE-2025-68114