kernel: HID: core: fix shift-out-of-bounds in hid_report_raw_event

A flaw was found in the Linux kernel's Human Interface Device HID core. A local attacker with low privileges could exploit a shift-out-of-bounds vulnerability in the hidreportrawevent function. This occurs when the size of an integer in the snto32 function exceeds 32 bits, leading to an invalid...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an invalid input mapping that could lead to unexpected behavior...

RHEL 9 : firefox (RHSA-2025:21064)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21064 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: thunderbird...

Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-990755)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990755 advisory. In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAPTOMASK Shifting signed 32-bit value by 3...

Malicious code in eager_elephant_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a84ea671934d4935f63462e233b16c3968cbd95f6b6a5c8d6fbfdc2c0a3615cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-135232 Malicious code in lisa-kupat8-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078086aec213dd7b3ffa8c1a11fe2c9d60551fdb2a3c5e4e5d7159e08dfbde84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ade-sego33-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02a6402fdfb276431483546599cd49c78870db22935c699429b96063d45b04ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-kemplang83-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a16abbf760fa4554853d865ca86c836f2e5b72d1cfe2d4a1e8e51e45117b2fda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-martabak41-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c059288f1700ee71cfb038852e65966c05f8c9bc12e1499bdde795abe5afee47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in correct_toad_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d28c3d6ad0dc65f72c6bbffe017757db83b568ff28eef514d011a727633e9d4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136536 Malicious code in real_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dfa129a45a007da7abc878d17ac11eabd7c5e46fc826e63a6aaea5e807a6abe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-132240 Malicious code in bella-asinan100-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e49c15dc564aa3452be5c1bf520231e359fd91b54318ba02ead489997936e0b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kresna-rujaksoto28-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065d3ad0545e13c8b7edc0854cd4bcd967c6c145dffeb9e72e2ed23dfeb84e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in udin-lapis70-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 044cf9a56849e6dfa8442901970685cfb606914ecc02508c2069ce362713c6f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dear_caterpillar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78d5cdf7872e4c945aaa9470ed805280828c3ba0af081c6d4abb7599e4ebcca2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-taiwan29-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc8f1c1e734941636494e582e0866ee8d11604806f5f18ea4e1b51a29079e7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131773 Malicious code in zaki-oncom2-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a5d3e5e506c9cefbff76adfc896ff271f2a43d0263988a67ccbfdb2c0336e20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-brengkes32-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0778c50e1a3aa17ead1bae812f92a25f9e16b7974c505e7d077e70c3f209da85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...