CLSA-2025-1738632064 Fix CVE(s): CVE-2024-12088

SECURITY UPDATE: path traversal vulnerability via improper symlink verification, when using the --safe-links option - debian/patches/CVE-2024-12088.patch: make --safe-links stricter - CVE-2024-12088...

CLSA-2025-1738632046 Fix CVE(s): CVE-2024-12086, CVE-2024-12087, CVE-2024-12088

SECURITY UPDATE: possible information leak via checksum comparison - debian/patches/CVE-2024-12086.patch: fix info leak when connecting to malicious server - CVE-2024-12086 SECURITY UPDATE: arbitraty file write via inproper symlink verification - debian/patches/CVE-2024-12087.patch: fix writing...

Malicious code in safe-modules (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8910830c20437fe0cdc2496ec1c70717d8b37ebfb5d3682d94e64492d5265f9d Any computer that has this package installed or running should be considered...

MAL-2025-1230 Malicious code in safe-modules (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8910830c20437fe0cdc2496ec1c70717d8b37ebfb5d3682d94e64492d5265f9d Any computer that has this package installed or running should be considered...

CVE-2024-12269

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...

CVE-2024-12269 Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...

CVE-2024-12269

CVE-2024-12269 affects the Safe Ai Malware Protection for WP WordPress plugin. A missing capability check in export_db() in all versions up to and including 1.0.17 allows unauthenticated attackers to retrieve a complete dump of the site’s database. Connected sources confirm the vulnerability and ...

CVE-2024-12269 Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export

The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportdb function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the...

WordPress Safe Ai Malware Protection for WP plugin <= 1.0.17 - Missing Authorization to Unauthenticated Database Export vulnerability

Missing Authorization to Unauthenticated Database Export vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Safe Ai Malware Protection for WP versions = 1.0.17...

WordPress plugin Safe Ai Malware Protection for WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-21664

In the Linux kernel, the following vulnerability has been resolved: dm thin: make getfirstthin use rcu-safe list first function The documentation in rculist.h explains the absence of listemptyrcu and cautions programmers against relying on a listempty - listfirst sequence in RCU safe code. This i...

Exposed Dangerous Method or Function

Overview asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Exposed Dangerous Method or Function stems from the library's attribute access verification method, specifically within the onattribute node handler. The...

Important: rsync

Issue Overview: A flaw was found in the rsync daemon which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data...

CVE-2025-21664

In the Linux kernel, the following vulnerability has been resolved: dm thin: make getfirstthin use rcu-safe list first function The documentation in rculist.h explains the absence of listemptyrcu and cautions programmers against relying on a listempty - listfirst sequence in RCU safe code. This i...

CVE-2025-21664 dm thin: make get_first_thin use rcu-safe list first function

In the Linux kernel, the following vulnerability has been resolved: dm thin: make getfirstthin use rcu-safe list first function The documentation in rculist.h explains the absence of listemptyrcu and cautions programmers against relying on a listempty - listfirst sequence in RCU safe code. This i...

CVE-2025-21664

CVE-2025-21664 affects the Linux kernel dm-thin component. Root cause: get_first_thin did a non-RCU-safe sequence (list_empty -&gt; list_first) that could race with concurrent updates, risking dereferencing a stale/altered list head during process_deferred_bios flow and leading to a crash. Connec...

CVE-2025-21664

In the Linux kernel, the following vulnerability has been resolved: dm thin: make getfirstthin use rcu-safe list first function The documentation in rculist.h explains the absence of listemptyrcu and cautions programmers against relying on a listempty - listfirst sequence in RCU safe code. This i...

Rsync: --safe-links option bypass leads to path traversal

...

Security update for rsync

This update for rsync fixes the following issues: CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. bsc1234101 CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. bsc1234102 CVE-2024-12087: arbitrary file...

Security update for rsync

This update for rsync fixes the following issues: CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. bsc1234101 CVE-2024-12086: leak of a client machine's file contents through the processing of checksum data. bsc1234102 CVE-2024-12087: arbitrary file...