CVE-2025-71436
CVE-2025-71436 · Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.
CVSS 7.1 · Alta · EPSS 0,5%
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
raptor rdf syntax library
- Versiones
- ≥ 2.0.15, ≤ 2.0.16: Afectada (semver)
Sin corrección publicada
raptor2 Debian:12
- Versiones
- 2.0.15-4
- 2.0.15-4+deb12u1
- 2.0.16-1
- 2.0.16-2
- 2.0.16-3
- 2.0.16-4
- 2.0.16-5
- 2.0.16-6
- 2.0.16-7
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
raptor2 Debian:13
- Versiones
- 2.0.16-6
- 2.0.16-7
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
raptor2 Debian:14
- Versiones
- 2.0.16-6
- 2.0.16-7
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
Fuentes originales
- https://github.com/dajobe/raptor/issues/83
- https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575
- https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218
- https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287
- https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag
- https://nvd.nist.gov/vuln/detail/CVE-2025-71436