ALSA-2025:10837 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes CVE-2025-21991 For more details about the security issues, including the impact, a CVSS score, acknowledgments, an...

CVE-2025-1220

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

CVE-2025-1220 Null byte termination in hostnames

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

CVE-2025-6491

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

Fedora 41 : php (2025-da047483d8)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-da047483d8 advisory. PHP version 8.3.23 03 Jul 2025 Core: Fixed GH-18695 zendastexport - float number is not preserved. Oleg Efimov Do not delete main chunk in zendgc...

GHSA-XWMG-2G98-W7V9 vulnerabilities

Vulnerabilities for packages: nacos, tez, flyway, nacos-docker, apicurio-registry, spark, camunda-zeebe, dependency-track, elasticsearch, druid, hadoop-client-modules, apache-nifi-registry, wildfly, akhq, apache-nifi...

CVE-2025-4972

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality...

BELL-CVE-2025-38335

Bulletin has no description...

BELL-CVE-2025-38283

Bulletin has no description...

FreeBSD : libxslt -- unmaintained, with multiple unfixed vulnerabilities (b0a3466f-5efc-11f0-ae84-99047d0a6bcc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b0a3466f-5efc-11f0-ae84-99047d0a6bcc advisory. Alan Coopersmith reports: On 6/16/25 15:12, Alan Coopersmith wrote: BTW, users of libxml2 may...

git-2.50.1-1.1 on GA media (moderate)

git-2.50.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15337-1 Rating: moderate Cross-References: CVE-2025-27613 CVE-2025-27614 CVE-2025-46334 CVE-2025-46835 CVE-2025-48384 CVE-2025-48385 CVE-2025-48386 CVSS scores: CVE-2025-27613 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N...

trivy-0.64.1-1.1 on GA media (moderate)

trivy-0.64.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15341-1 Rating: moderate Cross-References: CVE-2025-53547 CVSS scores: CVE-2025-53547 SUSE : 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H CVE-2025-53547 SUSE : 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H...

[slackware-security] Slackware 15.0 kernel

New kernel packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/kernel-firmware-2025070899d64b4-noarch-1.txz: Upgraded. patches/packages/linux-5.15.187/kernel-generic-5.15.187-i586-1.txz: Upgraded...

CVE-2025-5992

A denial of service flaw has been discovered in the Qt library. A call to QColorTransferGenericFunction may cause a crash if passed a maliciously crafted ICC profile. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

MGASA-2025-0205 Updated golang packages fix security vulnerabilities

Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools such as directly cloning Git or Mercurial repositories can cause the toolchain to execute unexpected commands, if said...

CVE-2025-52985

CVE-2025-52985 describes a Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved. When a firewall filter applied to the lo0 or re:mgmt interface references a prefix list and that list contains more than 10 entries, the prefix list may fail to ...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup bsc1237913. CVE-2024-58053: rxrpc: Fix handling of received connection abort bsc1238982...

CVE-2025-6838

creationtimestamp| type| source ---|---|--- 2025-07-11 10:14:25+00:00| seen| https://bsky.app/profile/potato.software/post/3ltomdlapvz2t...

CVE-2025-5241 Denial-of-Service Vulnerability in MELSEC iQ-F Series

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unabl...

AlmaLinux 8 : kernel (ALSA-2025:10669)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10669 advisory. kernel: Bluetooth: Fix use after free in hcisendacl CVE-2022-49111 kernel: Bluetooth: hcisync: Fix queuing commands when HCIUNREGISTER is set...