libblockdev security update

2.28-14.0.1 - enable btrfs support Orabug: 30792917 2.28-14 - Don't allow suid and dev set on fs resize CVE-2025-6019 Resolves: RHEL-96038...

Security update for nodejs20

This update for nodejs20 fixes the following issues: Update to 20.19.2: CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. CVE-2025-23167: improper HTTP header block termination in llhttp bsc1243220. CVE-2025-23165: add missing call to...

Security update for libblockdev

This update for libblockdev fixes the following issues: CVE-2025-6019: Suppress privilege escalation during xfs fs resize bsc1243226 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run th...

CVE-2022-50056: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix missing iop in ntfsreadmft There is null pointer dereference because iop == NULL. The bug happens because we don't initialize iop for records in $Extend...

CVE-2022-50057: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL deref in ntfsupdatemftmirr If ntfsfillsuper wasn't called then sbi-sb will be equal to NULL. Code should check this ptr before dereferencing. Syzbot hit this issue via passing wrong mount param as can be seen...

CVE-2025-38017: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs/eventpoll: fix endless busy loop after timeout has expired After commit 0a65bc27bd64 "eventpoll: Set epoll timeout if it's in the future", the following program would immediately enter a busy loop in the kernel: int main int e...

PT-2025-25993 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free bug has been identified in the Linux kernel, specifically in the btrfs file system. The issue arises when the btrfs commit transaction function fails, causing the relo...

Debian: Security Advisory (DLA-4214-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4214-1] node-tar-fs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4214-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 11, 2025 https://wiki.debian.org/LTS -...

Debian dla-4214 : node-tar-fs - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4214 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4214-1 [email protected]...

Directory Traversal

tar-fs is vulnerable to Directory traversal. The vulnerability is due to improper path validation during tarball extraction, allowing attackers to write files outside the target directory and potentially overwrite system files or inject malicious content...

@capriza/far (>=0.1.2, <=2.4.2), @cobalt-engine/cobower (2.0.0) +160 more potentially affected by CVE-2025-48387 via tar-fs (>=1.0.0, <=1.16.3)

tar-fs NPM version =1.0.0, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.0.5, =1.1.4 - @elm-node/npm-scripts 1.0.0 - @hlsrules-test/fc-libreoffice 1.0.0 and more Source cves: CVE-2025-48387 Source advisory: OSV:GHSA-8CJ5-5RVV-WF4V...

007putra-my-bot (1.1.1), 10bis-shufersal-automation (1.0.0) +4595 more potentially affected by CVE-2025-48387 via tar-fs (>=2.0.0, <=2.1.2)

tar-fs NPM version =2.0.0, =0.2.0, =1.0.0, =1.0.0, =0.107.10, =1.19.19, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2025-48387 Source advisory: OSV:GHSA-8CJ5-5RVV-WF4V...

0wcc9yywcywy (1.0.0), 0wu8yw8by8cw (1.0.0) +2415 more potentially affected by CVE-2025-48387 via tar-fs (>=3.0.2, <=3.0.8)

tar-fs NPM version =3.0.2, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-48387 Source advisory: OSV:GHSA-8CJ5-5RVV-WF4V...

GHSA-8CJ5-5RVV-WF4V tar-fs can extract outside the specified dir with a specific tarball

Impact v3.0.8, v2.1.2, v1.16.4 and below Patches Has been patched in 3.0.9, 2.1.3, and 1.16.5 Workarounds You can use the ignore option to ignore non files/directories. js ignore , header // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory...

tar-fs can extract outside the specified dir with a specific tarball

Impact v3.0.8, v2.1.2, v1.16.4 and below Patches Has been patched in 3.0.9, 2.1.3, and 1.16.5 Workarounds You can use the ignore option to ignore non files/directories. js ignore , header // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory...

DEBIAN-CVE-2025-48387

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

AZL-62236 CVE-2025-48387 affecting package reaper for versions less than 3.1.1-19

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

UBUNTU-CVE-2025-48387

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

org.webjars.npm:better-sqlite3 (12.11.1), org.webjars.npm:image-thumbnail (1.0.15) +4 more potentially affected by CVE-2025-48387 via org.webjars.npm:tar-fs (2.1.5)

org.webjars.npm:tar-fs MAVEN version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:tar-fs and may be impacted: - org.webjars.npm:better-sqlite3 12.11.1 - org.webjars.npm:image-thumbnail 1.0.15 - org.webjars.npm:pkg-fetch 3.4.2 -...