USN-7328-3: Linux kernel vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

CVE-2025-24049

Improper neutralization of special elements used in a command 'command injection' in Azure Command Line Integration CLI allows an unauthorized attacker to elevate privileges locally...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-27403

Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment, Ratify can be configured to authenticate to a private Azu...

GO-2025-3511 Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify...

USN-7344-2: Linux kernel vulnerabilities

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2024-23848 Attila Szász discovered that the HFS+ file system...

The vulnerability of the Azure Arc software for connecting local infrastructure lies in the lack of data cleansing measures at the management level, allowing attackers to escalate their privileges.

The vulnerability of the Azure Arc software installer for local infrastructure is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Azure Promptflow application development tool, related to insufficient spatial partitioning, allows a hacker to execute arbitrary code.

The vulnerability of the Azure Promptflow application development tool is related to insufficient spatial separation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2025:0847-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0847-1 advisory. The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following securit...

Security Updates for Azure CLI (March 2025)

The Microsoft Azure CLI installation on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. Note that Nessus has not tested for these issues but has instead relied only on th...

Azure Linux 3.0 Security Update: shim (CVE-2023-40551)

The version of shim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-40551 advisory. - A flaw was found in the MZ binary format in Shim. An out-of-bounds read May occur, leading to a crash or...

The vulnerability of the Command Line Interface (CLI) on the Microsoft Azure platform, which allows a hacker to increase their privileges

The vulnerability of the Command Line Interface CLI of the Microsoft Azure platform is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Azure Agent for Backup software, which is responsible for data backup, and the Azure Agent for Site Recovery software, which handles replication and disaster recovery, allows a malicious individual to elevate their privileges to a system-level level.

The vulnerability of the Azure Agent for Backup software, as well as the Azure Agent for Site Recovery software, relates to insecure privilege management. Exploiting this vulnerability could allow an attacker to elevate their privileges to a system-level level...

SUSE-SU-2025:0847-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-26708: mptcp: fix inconsistent state on fastopen race bsc1222672. - CVE-2024-40980: dropmonitor: replace spinlock by rawspinlock bsc1227937. -...

Microsoft Azure Arc Installer Elevation of Privilege Vulnerability

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. An elevation of privilege vulnerability exists in Microsoft Azure Arc Installer, which can be exploited by an attacker to elevate privileges...

Microsoft Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

Microsoft Azure Agent Installer for Backup and Site Recovery provides disaster recovery solutions for local computers and Azure VMs. An elevation of privilege vulnerability exists in Microsoft Azure Agent Installer for Backup and Site Recovery, which can be exploited by an attacker to elevate...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges or execute arbitrary code with the privileges of the vulnerable application. Azure PromptFlow:...

Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

GHSA-GPRR-V9F2-PX3C Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...