PT-2025-1067

Name of the Vulnerable Software and Affected Versions Junos OS versions 21.4 through 21.4R3-S9 Junos OS versions 22.2 through 22.2R3-S5 Junos OS versions 22.3 through 22.3R3-S4 Junos OS versions 22.4 through 22.4R3-S5 Junos OS versions 23.2 through 23.2R2-S3 Junos OS versions 23.4 through 23.4R2-...

PT-2025-1072

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 21.2R3-S9 Junos OS versions from 21.4 before 21.4R3-S10 Junos OS versions from 22.2 before 22.2R3-S5 Junos OS versions from 22.3 before 22.3R3-S4 Junos OS versions from 22.4 before 22.4R3-S3 Junos OS versions from 23...

PT-2025-1071

Name of the Vulnerable Software and Affected Versions Junos OS versions 21.4 through 24.2R1-S2, 24.2R2 Junos OS Evolved versions 21.4-EVO through 24.2-EVO Description The issue is related to an Out-of-Bounds Read vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and...

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...

libreswan: Invalid IKEv1 Quick Mode ID causes restart

A NULL pointer dereference flaw was found in Libreswan when processing IKEv1 Quick Mode requests. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, it triggers a NULL pointer dereference error. This flaw allows a malicious client or...

libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the...

libreswan: Invalid IKEv2 REKEY proposal causes restart

An assertion failure flaw was found in the Libreswan package that occurs when processing IKEv2 REKEY requests. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notification INVALIDSPI is sent back. The notify payload's protocol ID is copied from...

libreswan: Invalid IKEv1 Quick Mode ID causes restart

A NULL pointer dereference flaw was found in Libreswan when processing IKEv1 Quick Mode requests. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, it triggers a NULL pointer dereference error. This flaw allows a malicious client or...

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...

libreswan: Invalid IKEv1 Quick Mode ID causes restart

A NULL pointer dereference flaw was found in Libreswan when processing IKEv1 Quick Mode requests. When an IKEv1 Quick Mode connection configured with IDIPV4ADDR or IDIPV6ADDR receives an IDcr payload with IDFQDN, it triggers a NULL pointer dereference error. This flaw allows a malicious client or...

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...

libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the...

The vulnerability of the radosgw daemon in the Ceph storage system allows a hacker to bypass the authentication process.

The vulnerability of the radosgw daemon in the Ceph storage system is related to insufficient verification of data authenticity when processing JWT tokens. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures...

PT-2026-1058

Name of the Vulnerable Software and Affected Versions gpsd versions prior to commit ffa1d6f40bca0b035fc7f5e563160ebb67199da7 Description An integer underflow issue exists in the nextstate function within gpsd/packet.c. This occurs when parsing a NAVCOM packet, where the payload length is calculat...

PT-2026-5507

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.18 Description The Linux kernel contains an issue within the Rust Binder component. A missing consideration during the forward-porting of Rust Binder to version 6.18, specifically neglecting commit fb56fdf8b9a2...

PT-2025-37452

Name of the Vulnerable Software and Affected Versions: GNU Guix versions prior to 1618ca7 Description: A content-addressed-mirrors file can be written to create a setuid program. This allows a regular user to gain the privileges of the build user, even after the build process has completed...

CVE-2024-53217

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4processcbupdate @ses is initialized to NULL. If nfsd4findbackchannel finds no available backchannel session, setupcallbackclient will try to dereference @ses and segfault...

SUSE CVE-2024-53146

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is = U32MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decodecbcompound4res...

SUSE CVE-2024-53216

In the Linux kernel, the following vulnerability has been resolved: nfsd: release svcexpkey/svcexport with rcuwork The last reference for cachehead can be reduced to zero in cshow and eshowusing rcureadlock and rcureadunlock. Consequently, svcexportput and expkeyput will be invoked, leading to tw...

CVE-2024-56558

In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svcexportshow The function eshow was called with protection from RCU. This only ensures that exp will not be freed. Therefore, the reference count for exp can drop to zero, which will trigger a...