DEBIAN-CVE-2025-21696

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

UBUNTU-CVE-2025-21696

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

CVE-2025-21696

CVE-2025-21696 (Linux kernel) : Affects memory management with userfaultfd (UFFD). When mremap() moves a region previously registered with UFFD_WP but without UFFD_FEATURE_EVENT_REMAP, the code could fail to clear uffd-wp on PTE/PMD, causing a mismatch between vma flags (UFFD_WP cleared) and PTE/...

CVE-2025-21696

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

CVE-2025-21696 mm: clear uffd-wp PTE/PMD state on mremap()

In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap When mremaping a memory region previously registered with userfaultfd as write-protected but without UFFDFEATUREEVENTREMAP, an inconsistency in flag clearing leads to a mismatch between t...

PT-2025-16685

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the function flush tlb range when used for zapping normal PMD entries. The issue is associated with the collapse pte...

ch.acanda.maven:code-analysis-maven-plugin (>=0.1.0, <=1.14.0), com.eventoframework:evento-cli (>=ev1.4.1, <=ev1.15.5) +103 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-core (>=6.21.0, <=7.9.0)

net.sourceforge.pmd:pmd-core MAVEN version =6.21.0, =0.1.0, =ev1.4.1, =ev1.4.1, =2.23.0, =1.1.1, =1.0.2, =1.2.0, =0.22.2, =0.22.2, =2.10.2, =3.15.1, =1.0.0, =1.0.1 and more Source cves: CVE-2025-23215 Source advisory: OSV:GHSA-88M4-H43F-WX84...

GHSA-88M4-H43F-WX84 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Summary While rebuilding PMD Designer for Reproducible Builds and digging into issues, I found out that passphrase for gpg.keyname=0xD0BF1D737C9A1C22 is included in jar published to Maven Central. Details See...

PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

Summary While rebuilding PMD Designer for Reproducible Builds and digging into issues, I found out that passphrase for gpg.keyname=0xD0BF1D737C9A1C22 is included in jar published to Maven Central. Details See...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0, <=1.14.0), net.sourceforge.pmd:pmd-cli (>=7.0.0, <=7.9.0) +3 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (>=7.0.0, <=7.2.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0, =1.6.0, =7.0.0, =7.0.0, =2.0.0, =2.0.0, =3.0.3 Source cves: CVE-2025-23215 Source advisory: OSV:GHSA-88M4-H43F-WX84...

ch.acanda.maven:code-analysis-maven-plugin (>=0.1.0, <=1.14.0), com.eventoframework:evento-cli (>=ev1.4.1, <=ev1.15.5) +103 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-core (>=6.21.0, <=7.9.0)

net.sourceforge.pmd:pmd-core MAVEN version =6.21.0, =0.1.0, =ev1.4.1, =ev1.4.1, =2.23.0, =1.1.1, =1.0.2, =1.2.0, =0.22.2, =0.22.2, =2.10.2, =3.15.1, =1.0.0, =1.0.1 and more Source cves: CVE-2025-23215 Source advisory: GHSA-88M4-H43F-WX84...

CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0, <=1.14.0), net.sourceforge.pmd:pmd-cli (>=7.0.0, <=7.9.0) +3 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (>=7.0.0, <=7.2.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0, =1.6.0, =7.0.0, =7.0.0, =2.0.0, =2.0.0, =3.0.3 Source cves: CVE-2025-23215 Source advisory: SNYK:JAVA-NETSOURCEFORGEPMD-8685053...

Cleartext Storage of Sensitive Information

Overview net.sourceforge.pmd:pmd-designer is a graphical tool that helps PMD users develop their custom rules Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the form of the passphrase for gpg.keyname=0xD0BF1D737C9A1C22 appearing in the Maven jar ...

CVE-2025-23215

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215

PMD Designer’s release signing keys were found with passphrases exposed in Maven Central jars. The two compromised keys (94A5 2756 9CAF 7A47 AFCA BDE4 86D3 7ECA 8C2E 4C5B and EBB2 41A5 45CB 17C8 7FAC B2EB D0BF 1D73 7C9A 1C22) have been revoked; signatures on past artifacts remain valid, and the g...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215 PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...

CVE-2025-23215: Exposure of Sensitive Information to an Unauthorized Actor

PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in jar published to Maven Central. The private key itself is not known to have been compromised itself, but given its passphrase is, it must also be considered...