OPENSUSE-SU-2025-20113-1 Security update for dovecot24

This update for dovecot24 fixes the following issues: - Update dovecot to 2.4.2: - CVE-2025-30189: Fixed users cached with same cache key when auth cache was enabled bsc1252839 - Changes - auth: Remove proxyalways field. - config: Change settings history parsing to use python3. - doveadm: Print...

Malicious code in @trigo/bool-expressions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6798c49edd52f5db8414de6ec11538d35d915051f5d69bb07863965971915e57 The package @trigo/bool-expressions was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198666

Malicious code in @trigo/bool-expressions npm...

MAL-2025-190683 Malicious code in @trigo/bool-expressions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6798c49edd52f5db8414de6ec11538d35d915051f5d69bb07863965971915e57 The package @trigo/bool-expressions was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198671

Malicious code in bool-expressions npm...

Malicious code in bool-expressions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2dea19a068cf577e39f58533ccea7e2c6b5b0c9850de785f955a8f3304e2c9 The package bool-expressions was found to contain malicious code. Source: ghsa-malware 26f720c7eb2f6cce9791d2ffe73797674e5f19882b33308cde262deaa43671...

MAL-2025-190693 Malicious code in bool-expressions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2dea19a068cf577e39f58533ccea7e2c6b5b0c9850de785f955a8f3304e2c9 The package bool-expressions was found to contain malicious code. Source: ghsa-malware 26f720c7eb2f6cce9791d2ffe73797674e5f19882b33308cde262deaa43671...

[SECURITY] Fedora 41 Update: rust-regex-1.12.2-1.fc41

An implementation of regular expressions for Rust. This implementation uses finite automata and guarantees linear time matching on all inputs...

[SECURITY] Fedora 41 Update: rust-regex-automata-0.4.13-1.fc41

Automata construction and matching using regular expressions...

HSEC-2024-0009 Public key confusion in third-party blocks

Public key confusion in third-party blocks Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of t...

Siemens SIMATIC S7-1500 NULL Pointer Dereference (CVE-2018-14404)

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATHOPAND or XPATHOPOR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerab...

CVE-2025-40206 netfilter: nft_objref: validate objref and objrefmap expressions

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftobjref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c...

kernel: tracing/histograms: Fix memory leak problem

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 "tracing: fix double free" said, the "double free" problem reported by clang static analyzer is: In...

[SECURITY] Fedora 43 Update: rust-regex-automata-0.4.13-1.fc43

Automata construction and matching using regular expressions...

[SECURITY] Fedora 43 Update: rust-regex-1.11.3-1.fc43

An implementation of regular expressions for Rust. This implementation uses finite automata and guarantees linear time matching on all inputs...

CVE-2025-62798

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

EUVD-2025-36569

Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax...

Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

A Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser...

CVE-2025-62798

Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting XSS vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in & were evaluated by Vue. Thi...

libxml: Null pointer dereference leads to Denial of service (DoS)

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...