A stack based buffer overflow vulnerability has been reported in GNOME libsoup 2.58. The flaw is caused due to a boundary error within the "soup_filter_input_stream_read_until()" function when parsing chunk encoded HTTP traffic and affects both the server and client functionality of libsoup.

A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server functionality or by tricking a user into connecting to a malicious HTTP server with an application using the libsoup HTTP client functionality.

Please note that the libsoup packages as shipped with Red Hat Enterprise Linux 7 contain a "stack smashing protection" mitigation for the relevant function, which makes exploitation significantly harder. Thus, in most cases an exploitation attempt should be mitigated to a mere crash. However, successful exploitation to execute arbitrary code can't be ruled out entirely.