MAL-2025-42142 Malicious code in brave-real-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec706dec762e96c2e6f2990c75a05808c5226fdd400419402135c910c5e639a5 The OpenSSF Package Analysis project identified 'brave-real-launcher' @ 1.0.10 npm as malicious. It is considered malicious because: - The packa...

Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

...

kunit/overflow: Fix UB in overflow_allocation_test

...

The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 123.

...

Undefined Behavior in bounded Crossbeam channel

...

An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 126.

...

Malicious code in brave-real-launcher-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 122c2679d9d37502dadc2f4e54a52772fc880d7579ccefd7f530a9981e8e744c The OpenSSF Package Analysis project identified 'brave-real-launcher-v2' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

Malicious code in camelize-http-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a51a98ebb3bf39ce4592df2daa07de423db9f54f9b5c31e5a0b42f2371cd6024 The OpenSSF Package Analysis project identified 'camelize-http-headers' @ 1.1.1 npm as malicious. It is considered malicious because: - The...

glib: buffer overflow in set_connect_msg()

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4CONNMSGLEN. This issue may lead to an application crash or other undefined behavior...

Malicious code in authzd-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 45ba3e72eb15bda66737b4c0b7addefe2fa72e79d4a38a82e9dd53722cc04f7b The OpenSSF Package Analysis project identified 'authzd-client' @ 0.11.10.r813fef313 rubygems as malicious. It is considered malicious because: ...

MAL-2025-46924 Malicious code in advisory_db_toolkit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f9757e1ad29ad430d32886a0fcfa47e48a29e5e4af901f48e305216133028e6 The OpenSSF Package Analysis project identified 'advisorydbtoolkit' @ 99.99.99 rubygems as malicious. It is considered malicious because: - The...

MAL-2025-46926 Malicious code in github_chatops_extensions (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6269b59c516350c690f7fdf09dff674c52173f38074e8ac6f7b012352851797b The OpenSSF Package Analysis project identified 'githubchatopsextensions' @ 0.5.2.96.g33cefed rubygems as malicious. It is considered malicious...

Malicious code in monolith-twirp-merge-queue-go-mergequeuemonolith (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58e829a595050f4922bb0937c2d6c0d2759059af987ceb38f0c33712345eadc2 The OpenSSF Package Analysis project identified 'monolith-twirp-merge-queue-go-mergequeuemonolith' @ 1.0.2 rubygems as malicious. It is consider...

Malicious code in monolith-twirp-github-repositories (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6ab9bea194d9fa5ad57b833b09316a0c338a6beb920638e9aff880730969c89 The OpenSSF Package Analysis project identified 'monolith-twirp-github-repositories' @ 1.0.0 rubygems as malicious. It is considered malicious...

Malicious code in secret-scanning-proto (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1465959a0117b88d5bd9a996a386b97399277821a3199d62026605750c8194b7 The OpenSSF Package Analysis project identified 'secret-scanning-proto' @ 99.99.99 rubygems as malicious. It is considered malicious because: -...

Malicious code in monolith-twirp-webhooksubscriptions-subscriptions (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis df56bfac6f56194f6dc4db74f8761484bd20d2a46e61558f757a3179e3e249e8 The OpenSSF Package Analysis project identified 'monolith-twirp-webhooksubscriptions-subscriptions' @ 1.5.0 rubygems as malicious. It is...

Malicious code in monolith-twirp-git_src_migrator-monolith (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 060f3ebfeb0862be79294c75a97aaa823e0378ae4ef10ce1910472c923b31dc3 The OpenSSF Package Analysis project identified 'monolith-twirp-gitsrcmigrator-monolith' @ 1.6.3 rubygems as malicious. It is considered malicio...

MAL-2025-46939 Malicious code in proto-dependabot-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 020a9f64907bc95144ea451f388a29465ae090673bbbcc3adcabe76b5862bf73 The OpenSSF Package Analysis project identified 'proto-dependabot-api' @ 1.1.3.r8cdd21224 rubygems as malicious. It is considered malicious...

MAL-2025-46928 Malicious code in monolith-twirp-git_src_migrator-monolith (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 060f3ebfeb0862be79294c75a97aaa823e0378ae4ef10ce1910472c923b31dc3 The OpenSSF Package Analysis project identified 'monolith-twirp-gitsrcmigrator-monolith' @ 1.6.3 rubygems as malicious. It is considered malicio...

Malicious code in octolytics (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5d86b4c4ce77a41bee827eb614c38868e1231feef6629f9baf9cc665e472f530 The OpenSSF Package Analysis project identified 'octolytics' @ 0.19.0 rubygems as malicious. It is considered malicious because: - The package...