GCVE - cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Pocoproject (`18ec73c8-d2b9-565e-a54b-35b0c3c8a69d`)
Product	Poco (`ea74af2a-0e77-5409-9330-c0324d8b5b8b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/poco`	purl2cpe	2026-06-01 10:17:36.532226
`pkg:deb/ubuntu/poco`	purl2cpe	2026-06-01 10:17:36.532229
`pkg:github/pocoproject/poco`	purl2cpe	2026-06-01 10:17:36.532232
`pkg:maven/org.pocoproject.twilio/twilio-poco`	purl2cpe	2026-06-01 10:17:36.532235
`pkg:rpm/fedora/poco`	purl2cpe	2026-06-01 10:17:36.532237
`pkg:sourceforge/poco`	purl2cpe	2026-06-01 10:17:36.532240
`pkg:sourceforge/poco.mirror`	purl2cpe	2026-06-01 10:17:36.532243

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-6375`	vulnerable	2026-06-08 07:43:14.940611	poco MultipartReader.cpp MultipartInputStream null pointer dereference LOW (3.3) A vulnerability was found in poco up to 1.14.1. It has been rated as problematic. Affected by this issue is the function MultipartInputStream of the file Net/src/MultipartReader.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.14.2 is able to address this issue. The patch is identified as 6f2f85913c191ab9ddfb8fae781f5d66afccf3bf. It is recommended to upgrade the affected component. Published: 2025-06-21T00:31:06.881Z Updated: 2025-06-23T14:44:10.943Z Open on db.gcve.eu Reference links https://vuldb.com/?id.313370 https://vuldb.com/?ctiid.313370 https://vuldb.com/?submit.597446 https://github.com/pocoproject/poco/issues/4915 https://github.com/user-attachments/files/19524599/poco_crash.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-52389`	vulnerable	2026-06-08 06:17:55.024354	Details available UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0. Published: 2024-01-27T00:00:00.000Z Updated: 2025-05-29T15:11:56.786Z Open on db.gcve.eu Reference links https://pocoproject.org/blog/?p=1226 https://github.com/pocoproject/poco/issues/4320 https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000472`	vulnerable	2026-06-08 05:08:34.593196	Details available The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability". Published: 2018-01-03T20:00:00.000Z Updated: 2024-08-05T22:00:41.514Z Open on db.gcve.eu Reference links https://github.com/pocoproject/poco/issues/1968 https://www.debian.org/security/2018/dsa-4083 https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.