CVE-2025-60018

MediumCVSS 4.8/10Last modified Nov 6, 2026

Description

glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
——>= 2.60, < 2.80.2
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Sep 25, 2025
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-600193.7glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could pCVE-2025-60027.2An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload CVE-2025-600206.4nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.CVE-2025-600219.8Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attCVE-2025-600222.3Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a maCVE-2025-600234.0A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenCVE-2025-600248.8Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet CVE-2025-60035.3The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a fuCVE-2025-600358.8A vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are CVE-2025-600368.8A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are aCVE-2025-600378.8A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by paCVE-2025-600388.8A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by pa
CVE-2025-60018: Medium severity, CVSS 4.8 | Vulnix