MAL-2025-24395 Malicious code in kelp-phv21-uhi1b-rose-project (npm)

The package kelp-phv21-uhi1b-rose-project was found to contain malicious code...

MAL-2025-32449 Malicious code in rose-kiwi-xed630-project (npm)

The package rose-kiwi-xed630-project was found to contain malicious code...

MAL-2025-14570 Malicious code in ant-rose-klv704-project (npm)

The package ant-rose-klv704-project was found to contain malicious code...

MAL-2025-32452 Malicious code in rose-nymph-esr138-project (npm)

The package rose-nymph-esr138-project was found to contain malicious code...

MAL-2025-32453 Malicious code in rose-opal-sya256-project (npm)

The package rose-opal-sya256-project was found to contain malicious code...

MAL-2025-32447 Malicious code in rose-elephant-ylu913-project (npm)

The package rose-elephant-ylu913-project was found to contain malicious code...

MAL-2025-32439 Malicious code in rose-7s48w-kfxh9-blossom-project (npm)

The package rose-7s48w-kfxh9-blossom-project was found to contain malicious code...

Malicious code in dandelion-rose-xhe828-project (npm)

The package dandelion-rose-xhe828-project was found to contain malicious code...

Malicious code in rose-7s48w-kfxh9-blossom-project (npm)

The package rose-7s48w-kfxh9-blossom-project was found to contain malicious code...

Malicious code in valley-rose-emz716-project (npm)

The package valley-rose-emz716-project was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2022-2318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any...

DEBIAN-CVE-2025-38377

In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rosertdevicedown There are two bugs in rosertdevicedown that can cause use-after-free: 1. The loop bound t-count is modified within the loop, which can cause the loop to terminate early an...

UBUNTU-CVE-2025-38377

In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rosertdevicedown There are two bugs in rosertdevicedown that can cause use-after-free: 1. The loop bound t-count is modified within the loop, which can cause the loop to terminate early an...

USN-7651-6 linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

USN-7651-5 linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

CVE-2022-50163 ax25: fix incorrect dev_tracker usage

In the Linux kernel, the following vulnerability has been resolved: ax25: fix incorrect devtracker usage While investigating a separate rose issue 1, and enabling CONFIGNETDEVREFCNTTRACKER=y, Bernard reported an orthogonal ax25 issue 2 An ax25dev can be used by one or many struct ax25cb. We thus...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/rose: integer overflows can occur when using rosesetsockopt with potentially excessively large arguments, along with additional values being applied to them. To mitigate this issue, perform the following actions as a minimum...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - net: rose: locking the socket in rosebind - syzbot reported a soft lockup in roseloopbacktimer, with repro calls to bind from multiple threads. RoseBind must lock the socket to avoid this issue...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: rose: Fix for timer race conditions against user threads. The Rose timers only acquire the socket spinlock, without checking whether the socket is owned by a specific user thread. Add a check and reinitialize the timers i...

Malicious code in rose-web3-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e7bba39177d14d11698b3ccaeca36599df068894146efc99d0ded173449d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...