OESA-2025-2255 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Minor update (10) for Vivaldi Desktop Browser 7.5

Download Vivaldi The following improvements were made since the ninth 7.5 minor update: Chromium Update to 138.0.7204.261 CVE-2025-10200 Main photo byAmerican Heritage Chocolate...

CLSA-2025-1757666692 libtiff: Fix of CVE-2017-9117

CVE-2017-9117: add checks for all BMP reading operations to avoid buffer overflow...

CLSA-2025-1757663410 git: Fix of CVE-2024-50349

CVE-2024-50349: fix ANSI escape sequence vulnerability that occurs when asking for credentials interactively...

AZL-70955 CVE-2025-39762 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: add null check WHY Prevents null pointer dereferences to enhance function robustness HOW Adds early null check and return false if invalid...

CVE-2025-39748

In the Linux kernel, the following vulnerability has been resolved: bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpfgetnetnscookie 1: if r0 == 0 goto 2: if r0 & Oxffffffff goto The issue ...

AZL-67244 CVE-2025-39738 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes BUG There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key 594509824 169 0 itemoff 12599 itemsize 33 extent...

CVE-2025-39790 bus: mhi: host: Detect events pointing to unexpected TREs

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and...

CVE-2025-39788

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCIUTRLNEXUSTYPE On Google gs101, the number of UTP transfer request slots nutrs is 32, and in this case the driver ends up programming the UTRLNEXUSTYPE incorrectly as 0. This is because the...

CVE-2025-39785

In the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix irqrequest's irq name variable is local The local variable is passed in requestirq , and there will be use after free problem, which will make requestirq failed. Using the global irq name instead of it to...

CVE-2025-39780

In the Linux kernel, the following vulnerability has been resolved: sched/ext: Fix invalid task state transitions on class switch When enabling a schedext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following which can be easily reproduced by running t...

CVE-2025-39753

In the Linux kernel, the following vulnerability has been resolved: gfs2: Set .migratefolio in gfs2rgrp,metaaops Clears up the warning added in 7ee3647243e5 "migrate: Remove call to -writepage" that occurs in various xfstests, causing "something found in dmesg" failures. 341.136573 gfs2metaaops...

CVE-2025-39738

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes BUG There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key 594509824 169 0 itemoff 12599 itemsize 33 extent...

CLSA-2025-1757608775 python: Fix of CVE-2016-5636

CVE-2016-5636: fix heap-based buffer overflow in zipimport.c...

CLSA-2025-1757608663 rsync: Fix of CVE-2024-12087

CVE-2024-12087: fix a path traversal issue in --inc-recursive mode that let a malicious server escape the destination directory...

CLSA-2025-1757608338 python: Fix of CVE-2016-5636

CVE-2016-5636: fix heap-based buffer overflow in zipimport.c...

PT-2025-37249

Name of the Vulnerable Software and Affected Versions: OpenPrinting CUPS versions 2.4.12 and earlier Description: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. When the AuthType is set to anything but Basic, if a request contains an...

CLSA-2025-1757532130 pam: Fix of CVE-2025-6020

CVE-2025-6020: fix potential privilege escalation in pamnamspace...

[slackware-security] libssh

New libssh packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libssh-0.11.3-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fix NULL pointer dereference after allocation failure...

PT-2025-37098

Name of the Vulnerable Software and Affected Versions: Hoverfly versions 1.11.3 and prior Description: Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs lacks the authentication middleware present in the REST admin API. This allows an unauthenticated remote attacker to stream real-time...