AZL-66005 CVE-2024-48916 affecting package ceph for versions less than 18.2.2-10

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

DEBIAN-CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

glib: buffer overflow in set_connect_msg()

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4CONNMSGLEN. This issue may lead to an application crash or other undefined behavior...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to buffer overflow in the stack, allows a attacker to cause service interruptions.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted requests...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to uncontrolled memory distribution, allows a attacker to cause service interruptions.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted requests...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server lies in the improper elimination of special elements in data queries. This allows a malicious actor to cause service failures.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to the improper elimination of special elements in data queries. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by sending...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to buffer overflow in the stack, allows a attacker to cause service interruptions.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted requests...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server lies in the fact that resources are not released after their useful period has ended. This allows attackers to cause service failures.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability allows a malicious actor to cause service interruptions by...

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server, related to mutual flow blocking, allows a attacker to cause service failures.

The vulnerability of the IBM DB2 database management system and the IBM DB2 Connect Server automatic redirection server is related to mutual blocking of execution streams. Exploiting this vulnerability can allow an attacker to cause service interruptions...

CVE-2024-49828

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects App Connect Professional

Summary There are multiple vulnerabilities in the IBM SDK Java Technology used by App Connect Professional. These issue were disclosed as part of the IBM Java SDK updates in Apr 2025, App Connect Professional has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-21587 DESCRIPTIO...

RLSA-2025:3997 Important: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak...

RLSA-2025:4597 Moderate: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: DoS via Empty POST in modauthopenidc with OIDCPreservePost Enabled...

mod_auth_openidc:2.3 security update

An update is available for module.cjose, module.modauthopenidc, modauthopenidc, cjose. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

mod_auth_openidc:2.3 security update

An update is available for module.cjose, module.modauthopenidc, modauthopenidc, cjose. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

Security update for docker

This update for docker fixes the following issues: Update to Go 1.24 for builds, to match upstream. Update to Docker 28.3.2-ce. See upstream changelog online at Update to Docker 28.3.1-ce. See upstream changelog online at Update to Docker 28.3.0-ce. See upstream changelog online at bsc1246556...

SUSE CVE-2025-38443

In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbdgenlconnect error path There is a use-after-free issue in nbd: block nbd6: Receive control failed result -104 block nbd6: shutting down sockets ==================================================================...

DEBIAN-CVE-2025-38461

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport TOCTOU Transport assignment may race with module unload. Protect newtransport from becoming a stale pointer. This also takes care of an insecure call in vsockuselocaltransport; add a lockdep assert. BUG: unab...

UBUNTU-CVE-2025-38448

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: userial: Fix race condition in TTY wakeup A race condition occurs when gsstartio calls either gsstartrx or gsstarttx, as those functions briefly drop the portlock for usbepqueue. This allows gsclose and...