ALSA-2025:21926 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm: slub: avoid wake up kswapd in settrackprepare CVE-2025-39843 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

Security update for the Linux Kernel (Live Patch 51 for SUSE Linux Enterprise 15 SP3)

This update for the SUSE Linux Enterprise kernel 5.3.18-150300.59.185 fixes various security issues The following security issues were fixed: CVE-2022-50388: nvme: fix multipath crash caused by flush request when blktrace is enabled bsc1250295. CVE-2022-50432: kernfs: fix use-after-free in...

JLSEC-2025-228 Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations...

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...

Grub2: use-after-free in net_set_vlan

...

EUVD-2025-198253

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used...

CVE-2025-13445

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used...

CVE-2025-13446

A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclos...

CVE-2025-13446

A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclos...

CVE-2025-13446 Tenda AC21 SetSysTimeCfg stack-based overflow

A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclos...

CVE-2025-13446

CVE-2025-13446 affects the Tenda AC21 router. The vulnerability exists in the /goform/SetSysTimeCfg handler, where improper validation of the timeZone/time input leads to a stack-based buffer overflow. This can be exploited remotely without user interaction, enabling arbitrary code execution or a...

CVE-2025-13445

CVE-2025-13445 affects Tenda AC21 16.03.08.16. The issue is a stack-based buffer overflow in the /goform/SetIpMacBind handling, caused by insufficient validation of the argument list. This enables remote execution of code on the device, with exploit publicly published. CVSS-based assessments indi...

CVE-2025-13445 Tenda AC21 SetIpMacBind stack-based overflow

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used...

TencentOS Server 4: firefox (TSSA-2024:0162)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0162 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 4: xterm (TSSA-2025:0133)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0133 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EUVD-2025-198077

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused because the netsetvlan command is not properly unregistered when the network module is unloaded from memory. An attacker who...

DEBIAN-CVE-2025-54770

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused because the netsetvlan command is not properly unregistered when the network module is unloaded from memory. An attacker who...

CVE-2025-54770

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused because the netsetvlan command is not properly unregistered when the network module is unloaded from memory. An attacker who...

UBUNTU-CVE-2025-54770

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused because the netsetvlan command is not properly unregistered when the network module is unloaded from memory. An attacker who...

CVE-2025-54770

CVE-2025-54770 is a Use-After-Free in GRUB2’s network module (net_set_vlan) triggered when the network module is unloaded, allowing a local attacker to access freed memory and cause a DoS crash. Connected advisories (ALAS/OpenSUSE/SUSE) confirm this issue across grub2 packages and list affected r...

CVE-2025-54770 Grub2: use-after-free in net_set_vlan

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused because the netsetvlan command is not properly unregistered when the network module is unloaded from memory. An attacker who...