CVE-2025-47151: 
Linux Debian Análise e mitigação de vulnerabilidades

A type confusion vulnerability (CVE-2025-47151) was discovered in the lassonodeimplinitfromxml functionality of Entr'ouvert Lasso versions 2.5.1 and 2.8.2. The vulnerability was discovered by Keane O'Kelley and another member of Cisco Advanced Security Initiative Group, and was publicly disclosed on November 5, 2025 ([Talos](https://talosintelligence.com/vulnerabilityreports/TALOS-2025-2193)).

The vulnerability exists in the SAML Library's parsing functionality where a type confusion occurs during the ghashtableinsert operation. When parsing an attacker-controlled SAMLResponse, the lassonodeimplinitfromxml function incorrectly handles type casting, treating a string pointer as a GHashTable pointer. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and is classified as CWE-843 (Access of Resource Using Incompatible Type) (Talos).

Successful exploitation of this vulnerability can lead to arbitrary code execution. An attacker can send a malformed SAML response to trigger the vulnerability and potentially execute arbitrary code on the affected system (Talos).

The vulnerability was patched by the vendor on August 12, 2025. Users of affected versions (2.5.1 and 2.8.2) should upgrade to the patched version as soon as possible (Talos).