Bug 2416458 (CVE-2025-13132)

Summary:	CVE-2025-13132 dia: Dia: Spoofing vulnerability due to missing full-screen notification
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	redhat-bugzilla, saroy
Target Milestone:	---	Keywords:	Security
Target Release:	---	Flags:	redhat-bugzilla: needinfo? (saroy)
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dia. This vulnerability allows users to be misled about the current site via a malicious site rendering a fake user interface (UI) without a full-screen notification.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2417026, 2417027, 2417028, 2417029
Bug Blocks:

Description OSIDB Bzimport 2025-11-21 19:01:56 UTC

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)

Comment 2 Sandipan Roy 2025-11-25 15:42:51 UTC

$ newcli -svv dia
epel-8	pkg:rpm/fedora/dia.3-19.el8?arch=src
epel-9	pkg:rpm/fedora/dia.3-19.el9?arch=src
fedora-42	pkg:rpm/fedora/dia.3-29.fc42?arch=src
fedora-43	pkg:rpm/fedora/dia.3-30.fc43?arch=src

Comment 3 Robert Scheck 2026-01-04 02:48:13 UTC

According to https://www.diabrowser.com/security/bulletins#CVE-2025-13132 the CVE refers to the "Dia Browser" while "GNOME Dia" (https://wiki.gnome.org/Apps/Dia) is actually packaged as "dia".