This Week in Spring - September 2nd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Frankfurt, awaiting my flight to the Java-tastic Javazone 2025 event where I'll be joined by the legendary James Ward to deliver an AI-focused look at the latest-and-greatest in Spring! And I'm still recovering from th...

Linux Distros Unpatched Vulnerability : CVE-2025-22153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type...

CVE-2025-29890

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

BlueHat Asia 2025: Closing soon: Submit your papers by September 5, 2025

The next chapter of the Microsoft Security Response Center’s MSRC BlueHat security conference is fast approaching. BlueHat Asia 2025 will take place in Bengaluru, India, on November 5 – 6, 2025 and the Call for Papers is now open. Submissions will be accepted through September 5, 2025. Now in its...

Linux Distros Unpatched Vulnerability : CVE-2016-5416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7...

CVE-2025-38646: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band With a quite rare chance, RX report might be problematic to make SW think a packet is received on 6 GHz band even if the chip does not suppo...

Ubuntu: Security Advisory (USN-7682-6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2024-23638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against...

Oracle Linux 9 : libarchive (ELSA-2025-14130)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-14130 advisory. 3.5.3-6 - Resolves: CVE-2025-5914 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

libarchive security update

3.5.3-6 - Resolves: CVE-2025-5914...

RHEL 6 : tigervnc (RHSA-2025:13998)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13998 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it...

Malicious code in @zalastax/nolb-babel-6 (npm)

The package @zalastax/nolb-babel-6 was found to contain malicious code...

MAL-2025-10753 Malicious code in @zalastax/nolb-babel-6 (npm)

The package @zalastax/nolb-babel-6 was found to contain malicious code...

CVE-2025-54717 WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability

Missing Authorization vulnerability in e-plugins WP Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Membership: from n/a through 1.6.3...

PT-2025-32744

Name of the Vulnerable Software and Affected Versions: IntelR XeonR 6 processors affected versions not specified Description: An out-of-bounds write issue exists in the memory subsystem of certain IntelR XeonR 6 processors when utilizing IntelR SGX or IntelR TDX. A privileged user may be able to...

CVE-2025-22840: Sequence of Processor Instructions Leads to Unexpected Behavior

Sequence of processor instructions leads to unexpected behavior for some IntelR XeonR 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-22839: Insufficient Granularity of Access Control

Insufficient granularity of access control in the OOB-MSM for some IntelR XeonR 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access...

CVE-2025-22889: Improper Handling of Overlap Between Protected Memory Ranges

Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processor with IntelR TDX may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2025-26403: Out-of-bounds Write

Out-of-bounds write in the memory subsystem for some IntelR XeonR 6 processors when using IntelR SGX or IntelR TDX may allow a privileged user to potentially enable escalation of privilege via local access...

Intel® Distribution for Python Software Installer Advisory

Summary: A potential security vulnerability for some Intel® Distribution for Python software installers may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-26470 Description: Incorrect default...