SUSE-SU-2025:03604-1 Security update for samba

This update for samba fixes the following issues: - CVE-2025-9640: Fixed uninitialized memory disclosure via vfsstreamsxattr bsc1251279. - CVE-2025-10230: Fixed command Injection in WINS server hook script bsc1251280...

Security update for samba

This update for samba fixes the following issues: CVE-2025-9640: Fixed uninitialized memory disclosure via vfsstreamsxattr bsc1251279. CVE-2025-10230: Fixed command Injection in WINS server hook script bsc1251280. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

SUSE-SU-2025:03603-1 Security update for samba

This update for samba fixes the following issues: - CVE-2025-9640: Fixed uninitialized memory disclosure via vfsstreamsxattr bsc1251279. - CVE-2025-10230: Fixed command Injection in WINS server hook script bsc1251280...

CVE-2025-9640

The CVE-2025-9640 advisory concerns Samba’s vfs_streams_xattr module, where uninitialized heap memory can be written to alternate data streams, enabling an authenticated user to read residual memory and disclose sensitive data. Public references in Debian LTS (DLA-4384-1) state a fix in Samba 2:4...

CVE-2025-9640

A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability...

CVE-2025-54278

Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that ...

CVE-2025-54270

Animate versions 23.0.13, 24.0.10 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim...

CVE-2025-54278 Bridge | Heap-based Buffer Overflow (CWE-122)

Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that ...

CVE-2025-54278 Bridge | Heap-based Buffer Overflow (CWE-122)

Bridge versions 14.1.8, 15.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that ...

CVE-2025-54269 Animate | Out-of-bounds Read (CWE-125)

Animate versions 23.0.13, 24.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a...

PT-2025-42210

Animate versions 23.0.13, 24.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a...

UBUNTU-CVE-2025-9640

A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability...

Adobe Bridge 安全漏洞

Adobe Bridge is a file viewer from the American company Audobee Adobe. Adobe Bridge suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to cause the disclosure of sensitive information in memory...

uninitialized memory disclosure via vfs_streams_xattr

Description An authenticated user can read an unlimited number of samples of discarded heap memory, due to a failure to initialise memory in streamsxattrpwrite in the vfsstreamsxattr file server module. This is achieved by issuing write requests that creates holes in the file. Samba erases known...

CVE-2025-11710

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability affects Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11710 Cross-process information leaked due to malicious IPC messages

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

CVE-2025-11710

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

Mozilla Firefox ESR < 115.29

The version of Firefox ESR installed on the remote Windows host is prior to 115.29. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-82 advisory. - Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and...

Mozilla Thunderbird < 144.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 144.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-84 advisory. - Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory...

Mozilla -- Memory disclosure

[email protected] reports: A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process...