This Week in Spring - June 3rd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I just finished recording my session with IntelliJ IDEA project lead Aleksey Stukalov about all the amazing features coming to IntelliJ IDEA to better support Java, Kotlin, and Spring developers. It went off without a hitch...

PT-2025-28992

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains an issue within the networking subsystem, specifically related to the b53 driver for Broadcom BCM63xx switches. The driver attempts to enable Energy Efficient...

Fingerprinting Deep Learning Models Via Network Traffic Patterns in Federated Learning

Federated Learning FL is increasingly adopted as a decentralized machine learning paradigm due to its capability to preserve data privacy by training models without centralizing user data. However, FL is susceptible to indirect privacy breaches via network traffic analysis-an area not explored in...

kernel security update

5.14.0-570.19.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

The vulnerability of the “Copy as” function in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the “Copy as” function in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird on Windows operating systems is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability allows an attacker to execute arbitra...

Exploit for Code Injection in Langflow

Authenticated CVE-2025-3248 Langflow Remote Code Execution Th...

Exploit for CVE-2025-5287

Description: It is an exploit code that works for multiple...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' due to the improper validation of X-Forwarded-For and Forwarded headers forwarded from untrusted proxies. An attacker can manipulate the server's behavior by sending crafted headers fro...

[SECURITY] Fedora 42 Update: mingw-python-flask-3.1.1-1.fc42

MinGW Windows Python flask...

firefox security update

128.10.0-1.0.1 - Updated to 128.10.0 build Orabug: 37924620 - Fixes CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 and - CVE-2025-4093 128.9.0-2.0.1 - Update to 128.9.0 build2 Orabug: 37796786CVE-2025-3028CVE-2025-3029 CVE-2025-3030 128.8.0-1.0.1 - Update to 128.8.0 build1 Orabug:...

Falco 0.41.0

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco...

CVE-2025-48045, CVE-2025-48046, CVE-2025-48047: MICI NetFax Server Product Vulnerabilities (NOT FIXED)

In the course of a penetration testing engagement, Rapid7 discovered three vulnerabilities in MICI Network Co., Ltd’s NetFax server versions 3.0.1.0. These issues allowed for an authenticated attack chain resulting in Remote Code Execution RCE against the device as the root user. While...

USN-7521-3 linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Serial ATA and Parallel...

SUSE CVE-2025-5269

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.11 and Thunderbird 128.11...

Fortinet FortiPortal 日志信息泄露漏洞

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. Fortinet FortiPortal suffers from a log information disclosure vulnerability that originat...

May 28, 2025—KB5058481 (OS Build 19045.5917) Preview

None None...

CVE-2025-2796 On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal

On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be...

CVE-2025-2796

CVE-2025-2796 affects Arista EOS on platforms with hardware IPSec support where IPsec is enabled and anti-replay protection is configured. In certain cases, received duplicate encrypted packets that should be dropped by anti-replay protection are forwarded instead, as described by Arista’s adviso...

DEBIAN-CVE-2025-5267

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...

Malicious code in support-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28fe7c392e31b8cca3c992fa5ed19a3d8cd25412287a81ef8b7bf87d19012112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...