Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

OpenEuler Poco may crash on crafted input

published 24 days ago

Summary

The Poco library used in ROS Melodic can crash if it receives specially crafted multipart data, due to a null pointer error. This issue requires local access to exploit, but it could cause service interruptions. Update the library to version 1.14.2 to fix the problem.

What to do

Update openeuler poco to version 1.12.5p2-3.oe2403sp4.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP4	openeuler	poco	< 1.12.5p2-3.oe2403sp4 Fix: upgrade to 1.12.5p2-3.oe2403sp4

Original advisory text

poco security update

This is ROS melodic ros_comm&apos;s 3rdparty poco.

Security Fix(es):

A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component.(CVE-2025-6375)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6375 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.3 Low

Timeline

Published25 Sep 2026

Updated30 Sep 2026

First seen30 Sep 2026

Sources

OESA-2026-4090 · OSV

Track software like this

Free during beta