p PatchFirst

CVE-2025-6375

CVE-2025-6375 · poco MultipartReader.cpp MultipartInputStream null pointer dereference

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.

CVSS 4.8 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • poco

    Versions
    • 1.14.0: Affected
    • 1.14.1: Affected
    • 1.14.2: Not affected

    Update to 1.14.2

  • poco Debian:12

    Versions
    • 1.11.0-3
    • 1.11.0-3+deb12u1
    • 1.11.0-3+hurd.1
    • 1.11.0-4
    • 1.11.0-4.1
    • 1.13.0-1
    • 1.13.0-2
    • 1.13.0-3
    • 1.13.0-4
    • 1.13.0-5
    • 1.13.0-6
    • 1.14.2-1
    • 1.14.2-2
    • 1.14.2-3
    • 1.14.2-4
    • 1.14.2-5
    • 1.14.2-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Debian:13

    Versions
    • 1.13.0-6
    Affected ranges
    • ECOSYSTEM: < 1.13.0-6+deb13u1

    Update to 1.13.0-6+deb13u1

  • poco Debian:14

    Versions
    • 1.13.0-6
    • 1.14.2-1
    Affected ranges
    • ECOSYSTEM: < 1.14.2-2

    Update to 1.14.2-2

  • poco Ubuntu:14.04:LTS

    Versions
    • 1.3.6p1-4
    • 1.3.6p1-4+deb7u1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:16.04:LTS

    Versions
    • 1.3.6p1-5.1
    • 1.3.6p1-5.1build1
    • 1.3.6p1-5.1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:18.04:LTS

    Versions
    • 1.7.8+dfsg1-2
    • 1.7.8+dfsg1-3
    • 1.8.0.1-1ubuntu4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:20.04:LTS

    Versions
    • 1.9.2-3ubuntu2
    • 1.9.2-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:22.04:LTS

    Versions
    • 1.10.0-6
    • 1.11.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:24.04:LTS

    Versions
    • 1.11.0-3
    • 1.11.0-4
    • 1.11.0-4.1
    • 1.11.0-4.1build1
    • 1.11.0-4.1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:25.10

    Versions
    • 1.13.0-6build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:26.10

    Versions
    • 1.14.2-3
    • 1.14.2-6
    • 1.14.2-6ubuntu1
    • 1.14.2-6ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • poco Ubuntu:26.04:LTS

    Versions
    • 1.13.0-6build2
    • 1.14.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →