5953 matches found
Policy and Disclosure: 2025 Edition
Posted by Tim Willis, Google Project Zero In 2021, we updated our vulnerability disclosure policy to the current "90+30" model. Our goals were to drive faster yet thorough patch development, and improve patch adoption. While we’ve seen progress, a significant challenge remains: the time it takes...
Fedora: Security Advisory (FEDORA-2025-2fac68f810)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CLSA-2025-1753083608 Fix of 17 CVEs
Focal update: v5.4.292 upstream stable release LP: 2109357 // CVE-url: https://ubuntu.com/security/CVE-2025-37937 - objtool, media: dib8000: Prevent divide-by-zero in dib8000setdds Focal update: v5.4.287 upstream stable release LP: 2095145 // CVE-url: https://ubuntu.com/security/CVE-2024-53197 -...
Fedora 42 : screen (2025-f055a0d751)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f055a0d751 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...
Fedora 41 : screen (2025-653690f2f7)
The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-653690f2f7 advisory. Update default config options for build. ---- New upstream release 5.0.1 Tenable has extracted the preceding description block directly from the...
DEBIAN-CVE-2025-1713
When setting up interrupt remapping for legacy PCI-X devices, including PCI-X bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock...
ALPINE-CVE-2025-1713
When setting up interrupt remapping for legacy PCI-X devices, including PCI-X bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock...
UBUNTU-CVE-2025-1713
When setting up interrupt remapping for legacy PCI-X devices, including PCI-X bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock...
Fedora 42 : docker-buildx (2025-6ddb790d26)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6ddb790d26 advisory. - Update package to release v0.24.0 - Resolve: rhbz2366388, rhbz2360632 - Upstream fixes and changes Tenable has extracted the preceding description block...
UBUNTU-CVE-2025-5994
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...
SUSE CVE-2025-5994
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...
ALPINE-CVE-2025-5994
A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to...
Security update for xen
This update for xen fixes the following issues: Security fixes: CVE-2024-28956: Fixed Intel CPU: Indirect Target Selection ITS XSA-469 bsc1243117 CVE-2024-53241: Fixed Xen hypercall page unsafe against speculative attacks XSA-466 bsc1234282 CVE-2025-1713: Fixed deadlock potential with VT-d and...
CVE-2025-50079
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MyS...
CVE-2025-50091
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MyS...
PT-2025-37247
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the Linux kernel where the host may access stale data in the event ring due to a device updating the events ring pointer before updating the event contents. This can...
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file,...
SUSE CVE-2025-7370
Upon investigtion upstream maintainers discovered this was not a real issue. See the references for more details. See: https://gitlab.gnome.org/GNOME/libsoup/-/issues/430note2494090...
gio-branding-upstream-2.84.3-1.1 on GA media (moderate)
gio-branding-upstream-2.84.3-1.1 on GA media Announcement ID: openSUSE-SU-2025:15221-1 Rating: moderate Cross-References: CVE-2025-6052 CVSS scores: CVE-2025-6052 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-6052 SUSE : 7.3...