INFSA-2025:12100: libtpms security update
Information about definition
Identificator: INFSA-2025:12100
Type: security
Release date: 2025-07-31 16:10:58 UTC
Information about package
The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.
Vulnerabilities description
- CVE-2025-49133
A flaw was found in libtpms. A heap buffer overflow can occur in the tpms_parse_pssh function when parsing a malformed Public Signature Key Exchange (PSK) structure. A local attacker can trigger this overflow by providing a crafted PSK structure to the library. This can lead to a denial of service or allow for arbitrary code execution.
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2025-49133
|
no information | 5.9 | no information |
Updated packages