CVE-2025-5987: Return of Wrong Status Code

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with th...

CVE-2025-38230

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

CVE-2025-38230 jfs: validate AG parameters in dbMount() to prevent crashes

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount to prevent crashes Validate dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL,...

CVE-2025-38230

CVE-2025-38230 concerns the Linux kernel’s JFS subsystem. The issue arises from not validating AG parameters in dbMount(), allowing corrupted metadata to reach dbAllocAG and cause crashes. A UBSAN shift-out-of-bounds occurs in fs/jfs/jfs_dmap.c:1400 during dbAllocAG, as demonstrated by the trace ...

RUSTSEC-2025-0165 i_tree allowed out-of-bounds access through safe public node accessors

Affected versions of itree exposed safe public Tree::node and Tree::mutnode methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::getunchecked / getuncheckedmut on the internal node buffer, without validating that the index was in bounds...

CVE-2025-38217: Time-of-check Time-of-use (TOCTOU) Race Condition

In the Linux kernel, the following vulnerability has been resolved: hwmon: ftsteutates Fix TOCTOU race in ftsread In the ftsread function, when handling hwmonpwmautochannelstemp, the code accesses the shared variable data-fansourcechannel twice without holding any locks. It is first checked again...

PT-2025-55395

Affected versions of i tree exposed safe public Tree::node and Tree::mut node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get unchecked / get unchecked mut on the internal node buffer, without validating that the index was in...

RVISmith: Fuzzing Compilers for RVV Intrinsics

Modern processors are equipped with single instruction multiple data SIMD instructions for fine-grained data parallelism. Compiler auto-vectorization techniques that target SIMD instructions face performance limitations due to insufficient information available at compile time, requiring...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a TOCTOU competition condition leading to undefined behavior...

OESA-2025-1692 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: The ShmemCharMapHashEntry code was susceptible to potentially undefined behavior by bypassing the move semantics for one ...

OESA-2025-1691 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: The ShmemCharMapHashEntry code was susceptible to potentially undefined behavior by bypassing the move semantics for one ...

PT-2025-33777

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contained a flaw within the f2fs file system related to uninitialized values in the extent info structure. Specifically, the get read extent info function only...

Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : Botan vulnerabilities (USN-7586-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7586-1 advisory. It was discovered that Botan could have compiler dependent operations induced under certain circumstances. An attacker could possibly...

Advisory ROSA-SA-2025-2896

Software: zlib 1.2.7 OS: rosa-server79 packageevrstring: zlib-1.2.7-21.0.1.res7 CVE-ID: CVE-2025-4638 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: A vulnerability in the zlib library embedded in PointCloudLibrary PCL allows attackers to cause undefined behavior via incorrect pointer arithmetic...

USN-7586-1 botan vulnerabilities

It was discovered that Botan could have compiler dependent operations induced under certain circumstances. An attacker could possibly use this issue to cause undefined behavior. CVE-2024-50382, CVE-2024-50383 Bing Shi discovered that Botan did not limit the size of certain inputs when checking...

USN-7586-1: Botan vulnerabilities

It was discovered that Botan could have compiler dependent operations induced under certain circumstances. An attacker could possibly use this issue to cause undefined behavior. CVE-2024-50382, CVE-2024-50383 Bing Shi discovered that Botan did not limit the size of certain inputs when checking...

SUSE CVE-2022-50066

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aqvec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self-aqveci is not checked and then leads to the index out of range error. Also fixed this...

SUSE CVE-2025-38013

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set nchannels after allocating struct cfg80211scanrequest Make sure that nchannels is set after allocating the struct cfg80211registereddevice::intscanreq member. Seen with syzkaller: UBSAN:...

DEBIAN-CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...

ALPINE-CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's...