Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988930)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988930 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4renamedirprepare We got issue as follows: EXT4-fs loop0: mounted...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988712)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988712 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check for inline inode Yanming reported a kernel bug in Bugzilla kernel 1,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989799)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989799 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check for inline inode Yanming reported a kernel bug in Bugzilla kernel 1,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The cancle function marks a bad inode after attempting to remove a file name. The reproducer uses a file0 on an ntfs3 file system with a corrupted ilink. When renaming a file, the inode of file0 is marked as a bad inode...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed a race condition between rename operations and directory logging. We have a race condition between a rename operation and directory inode logging. If this race condition occurs, and the system crashes or loses power...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a race condition that occurred due to concurrent opens during the rename2 operation. In addition to sending the rename request to the server, the rename process also involves closing any deferred closes, waitin...

SUSE CVE-2025-40067

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already...

CVE-2025-56399

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...

EUVD-2025-36538

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload/rename API endpoints. An attacker can execute arbitrary code on the server by uploading a file with a .png or .pdf extension containing executable code, bypassing client-side validation, then...

CVE-2025-40067

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already...

UBUNTU-CVE-2025-40067

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already...

CVE-2025-40067

CVE-2025-40067 in the Linux kernel affects the NTFS3 file system: if the $BITMAP attribute is empty while index blocks exist, on-disk corruption can occur during operations like long-name renames. The fix adds a check to reject such cases by ensuring the bitmap is not empty when index blocks exis...

CVE-2025-40067 fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already...

CVE-2025-40067 fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already...

CVE-2025-56399

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...

CVE-2025-56399

CVE-2025-56399 affects alexusmai/laravel-file-manager 3.3.1 and earlier. An authenticated user can upload a PNG containing PHP code; the upload may bypass client-side validation and be saved on the server. By using the rename API to switch the extension to .php, the file can be accessed via a pub...

PT-2025-44188

Name of the Vulnerable Software and Affected Versions alexusmai laravel-file-manager versions prior to 3.3.2 Description An authenticated attacker can achieve Remote Code Execution RCE through a two-step process involving a crafted file upload. First, a file with a .png extension containing PHP...

CVE-2025-61105

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the showvtylinkinfo function at ospfext.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted OSPF packet...

SUSE CVE-2021-47637

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix deadlock in concurrent rename whiteout and inode writeback Following hung tasks: 77.028764 task:kworker/u8:4 state:D stack: 0 pid: 132 77.028820 Call Trace: 77.029027 schedule+0x8c/0x1b0 77.029067 mutexlock+0x50/0x60...