SUSE-SU-2025:1516-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2024-6119: Fixed denial of service in X.509 name checks bsc1229465 Other fixes: - FIPS: Deny SHA-1 signature verification in FIPS provider bsc1221365. - FIPS: RSA keygen PCT requirements. - FIPS: Check that the fips provider is available...

CVE-2025-36557

When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-36557

When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-36557 BIG-IP HTTP vulnerability

When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-36557

CVE-2025-36557 affects F5 BIG-IP BIG-IP Next and related platforms where an HTTP profile configured with Enforce RFC Compliance can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed requests. Impact is described as DoS with TMM restart disruption and potential data-pl...

CVE-2024-42213

HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure...

CVE-2024-42212

HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery CSRF attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions...

Meet the Deputy CISOs who help shape Microsoft’s approach to cybersecurity: Part 2

Microsoft launched its Cybersecurity Governance Council in 2024, and with it, named a group of deputy chief information security officers that ensure comprehensive oversight of the company’s cybersecurity risk, defense, and compliance. These leaders work in tandem with product and engineering...

USN-7494-5: Linux kernel (Azure FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network drivers; - Netfilter; CVE-2023-52664, CVE-2023-52927...

CVE-2025-36557: Buffer Copy without Checking Size of Input

When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

F5 BIG-IP security vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other features. A security vulnerability exists in F5 BIG-IP that stems from RFC compliance configuration leading to TMM termination...

Disable PermitUserEnvironment

PermitUserEnvironment allows users to set SSH environment variables, which may be exploited by attackers to launch attacks. If PermitUserEnvironment is set to yes, attackers can modify SSH environment variables to evade the security mechanism or execute attack code. This configuration must be...

Discard Forged ICMP Packets and Do Not Record Logs

Setting icmpignoreboguserrorresponses to 1 prevents the kernel from recording responses to duplicate broadcast packets, which prevents useless log information from filling in the file system. Some attackers send ICMP packets that violate RFC-1122 and attempt to fill the log file system with a lar...

Do Not Install the NIS Client

Network Information Service NIS works in client-server mode. NIS clients running the ypbind daemon obtain information from a server. NIS is inherently insecure and is vulnerable to DoS and buffer overflow attacks. Therefore, do not install the NIS client in the service scenario where NIS is not...

Do Not Install the X Window System

X Window System X for short provides a GUI for users to log in and perform operations in Linux. Generally, servers do not require a GUI. Administrators can configure and modify a server through the CLI. X SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a...

Do Not Install the Print Service

A server running Common Unix Printing System CUPS provides print services to other devices on the network. Running the CUPS service requires additional system resources and expands the attack surface. Therefore, do not start the CUPS service in the scenario where the CUPS service is not required...

Do Not Install the LDAP Service

Lightweight Directory Access Protocol LDAP is a protocol that provides access control and is used to maintain distributed directory information. The LDAP service increases system resource usage and expands the attack surface. If the LDAP service is not required, do not install the LDAP service. T...

Enable Kernel SMAP

Supervisor Mode Access Prevention SMAP can be enabled to prevent the kernel from accessing data in user space. If SMAP is not enabled, attackers can access data in user space through kernel-mode code redirection, which increases the attack surface and reduces system security. SMAP is enabled by...

Ensure That Partitions That Do Not Need to Be Modified Are Mounted as Read-Only

Mounting a file system that does not need to be modified as read-only can prevent unintentional or malicious data tampering and reduce the attack surface. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Do Not Install Network Sniffing Tools

If network sniffing tools exist in the production environment, attackers may use them for network analysis and attacks. Therefore, in the production environment, do not install network sniffing, packet capturing, or analysis tools, such as tcpdump, Ethereal, and Wireshark. SPDX-FileCopyrightText:...