Tuesday, July 15, 2025 Security Releases

Tuesday, July 15, 2025 Security Releases Security releases available Updates are now available for the 24.x, 22.x, 20.x Node.js release lines for the following issues. Windows Device Names CON, PRN, AUX Bypass Path Traversal Protection in path.normalize CVE-2025-27210 - high An incomplete fix has...

Important: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Better Glyph drawing CVE-2025-30749 JDK: Enhance TLS protocol support CVE-2025-30754 JDK: Improve HTTP client header handling CVE-2025-50059 JDK:...

MINI-CX94-P8GQ-HJ6H

Bulletin has no description...

Slackware: Security Advisory (SSA:2025-192-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Photon OS 4.0: Python3 PHSA-2025-4.0-0828

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0828. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MINI-FJPH-7VR4-RGX6

Bulletin has no description...

MINI-C4P5-Q63X-JQ26

Bulletin has no description...

Fedora 42 : httpd (2025-6d7a183951)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6d7a183951 advisory. New httpd 2.4.64 release + security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 41 : selenium-manager (2025-dda04d7a84)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-dda04d7a84 advisory. Update to version 4.34.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2025-46835

A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify th...

CGA-MHG4-342V-W7XQ

Bulletin has no description...

Fedora 42 : luajit (2025-b1082e9269)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b1082e9269 advisory. Fix CVE-2024-25176 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Security Updates for Microsoft Word Products (July 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-49698, CVE-2025-49700,...

Security Updates for Microsoft Visual Studio Products (July 2025)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities. - Vulnerability in Gitk where when a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. T...

Security Updates for Microsoft Office Online Server (July 2025)

The Microsoft Office Online Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. CVE-2025-48812 - A remote...

Security Updates for Microsoft Office Products (July 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-49695, CVE-2025-49696,...

Patch, track, repeat

Welcome to this week's edition of the Threat Source newsletter. We've made it halfway through 2025 already! It's been a while since I last wrote about CVEs and how free support for Windows 10 will end on October 14, 2025, leaving you with no more security fixes. While the CVE system remains the...

CVE-2025-7425

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may acce...

CVE-2025-38311

In the Linux kernel, the following vulnerability has been resolved: iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error prone logic of trylocks. Thanks to netdevlock by Jakub it is now easy, and in most cases we were protected by it already - replace crit lock by...

Fedora 41 : chromium (2025-c05ae72339)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c05ae72339 advisory. Update to 138.0.7204.92 High CVE-2025-6554: Type Confusion in V8 Tenable has extracted the preceding description block directly from the Fedora...