141 matches found
SUSE-SU-2025:3869-1 Security update for himmelblau
This update for himmelblau fixes the following issues: Update to version 0.7.18+git.0.8485a75. - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences could be injected into terminal output when logged bsc1249013...
EUVD-2020-19860
Malware in sbrugna...
EUVD-2019-18907
Malware in sbrugna...
EUVD-2022-0579
Malicious code in bioql PyPI...
EUVD-2025-26382
Malicious code in bioql PyPI...
Medium: glycin
Issue Overview: tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be...
CVE-2025-58160
A log pollution flaw was found in the tracing-subscriber Rust crate. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens, modify the terminal display, or potential...
SUSE CVE-2025-58160
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...
AZL-73223 CVE-2025-58160 affecting package rust for versions less than 1.90.0-4
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...
AZL-73247 CVE-2025-58160 affecting package rust 1.72.0-14
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into...
CVE-2025-55193
A flaw was found in activerecord. The find and similar methods may log unescaped identifiers passed as IDs, including ANSI escape codes. An attacker with the ability to directly observe the application's terminal output can view these unescaped sequences. This allows for the injection of ANSI...
CVE-2025-55193: Improper Neutralization of Escape, Meta, or Control Sequences
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in...
Control Character Injection
github.com/cilium/hubble is vulnerable to control character injection. The vulnerability is due to improper sanitization of control characters in the terminal output when monitoring Kafka traffic using Layer 7 Protocol Visibility and allows an attacker to manipulate output, conceal log entries, o...
CVE-2025-48056 Hubble CLI vulnerable to character injection
Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inject malicious control characters into Hubble CLI terminal output, potentially leading to loss of integrity and manipulation of the output...
PT-2025-54191
Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.26 Composer versions prior to 2.9.3 Description Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the...
flatpak: Metadata with ANSI control codes can cause misleading terminal output
A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Suppose an attacker publishes a Flatpak app with elevated permissions. In that case, they can hide those permissions from users of the flatpak1 command-line interface by setting...
less: Denial of service
Background less is a pager and text file viewer. Description less suffered from a flaw in its terminal escape sequence handling which made its filtering incomplete. Impact Malicious input could clear the terminal output or otherwise manipulate it with faked interactions. Workaround There is no...
SUSE-SU-2023:1712-1 Security update for flatpak
This update for flatpak fixes the following issues: - CVE-2023-28101: Fixed misleading terminal output with metadata with ANSI control codes bsc1209410. - CVE-2023-28100: Fixed unsandboxed TIOCLINUX commands bsc1209411...
CVE-2023-28101 Flatpak metadata with ANSI control codes can cause misleading terminal output
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak1 command-line...