PT-2025-25938 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the initialization of jump labels on 64-bit systems. Specifically, calling jump label init in setup featu...

Scattered Spider Aims at US Insurers After UK Retail Hit, Google Warns

Scattered Spider targets US insurance firms after UK retail attacks, using social engineering to breach help desks and disrupt services, Google warns...

Malicious code in vscode-websearchforcopilot (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 247d22ce4a478ffa11b9b10a31460cd13afeba961c80bf8f08a8557aef325569 Any computer that has this package installed or running should be considered...

Malicious code in graphlibcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10441453f5296007b2b77ca9e580f3ce0a3ac50607cae82a6fe5858aaf1b0dee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fixed warnings during S3 suspension The enablegpewakeup function calls acpienableallwakeupgpes, and this function may also call the preemptschedulecommon function. This results in a thread switch, causing the CPU to be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/slab/kvfreercu: The switch to WQMEMRECLAIM wq was implemented. Currently, the kvfreercu APIs use a system workqueue, which is “systemunboundwq” for driver RCU reclamation of memory. Recently, the following kernel warning was...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fixed an issue where a “off-by-one” root connection error occurred. Before attaching a new root to the old root, the number of children in the new root was checked to ensure that only the top-level groups of the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: perf/core: The order of the PMU list needs to be adjusted to fix a warning regarding an unordered pmuctxlist. The Syskaller trigger a warning because prevepc-pmu does not equal nextepc-pmu in perfeventswaptaskctxdata. vmcore...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: spi: cadence: Fixed an out-of-bounds array access in cdnsmrvlxspisetupclock If requestedclk 128, cdnsmrvlxspisetupclock iterates over the entire cdnsmrvlxspiclkdivlist array without exiting early, causing ‘i’ to go beyond the arr...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: The behavior of “openvswitch: switch to per-action label counting in conntrack” has been corrected. Currently, the ovsctsetlabels function is only called for confirmed conntrack entries within ovsctcommit. However, if the conntra...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: perf/amlogic: Replace smpprocessorid with rawsmpprocessorid in mesonddrpmucreate The Amlogic DDR PMU driver’s mesonddrpmucreate function incorrectly uses smpprocessorid, which assumes disabled preemption. This leads to kernel...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: iwlwifi: No warnings are displayed when there is a Firmware FW error. The iwltransreclaim function emits a warning if it is called when the FW is not active. However, if it is called during a pending restart, i.e., after...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: drv: netdevsim: do not call napicomplete from netpoll netdevsim supports netpoll. Make sure we do not call npaiComplete from it, as it may not be scheduled. Breno reported encountering a warning in npaiCompleteDone: WARNING:...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fixed the WARNON!ctx message in freeevent for partial initialization. The call to getctxchildctx and the assignment of childevent-ctx are now performed immediately after the childevent is allocated. Ensure that...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: idpf: fixed checksums set in idpfrxrsc idpfrxrsc uses skbtransportoffsetskb when the transport header is not yet set. This triggers the following warning in builds with CONFIGDEBUGNET=y:...

CVE-2025-49585

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...

CVE-2025-49585: Insufficient UI Warning of Dangerous Operations

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...

CVE-2025-0913

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

CVE-2025-4673

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

PT-2025-28990

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The netdevsim driver in the Linux kernel does not prevent calling napi complete from netpoll, which may not be scheduled. This can lead to a warning in napi complete done. The issue...