CVE-2025-0913

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

Symlink Attack

Overview std/os is a Go standard library package std/os Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems,...

Security Bulletin: AIX/VIOS is vulnerable to an expected behavior violation (CVE-2025-32728) due to OpenSSH

Summary AIX's OpenSSH DisableForwarding directive does not adhere to the documentation CVE-2025-32728. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2025-32728 DESCRIPTION: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the...

CVE-2025-5918

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

CVE-2025-5918 Libarchive: reading past eof may be triggered for piped file streams

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

CVE-2025-5915 Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory buffer, which can...

MAL-2025-4725 Malicious code in frontegg-nuxt-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dfeb24eb6c59e883dded7166ce9ff73fb43ab8352fcc2a154f86c7bf96be5e8 Any computer that has this package installed or running should be considered...

MAL-2025-4723 Malicious code in 0x000asdqwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ea8c61fc9f49cdc0f6a22b805c76011ff8bd9143b77d223068fdb6f7d0d342e The OpenSSF Package Analysis project identified '0x000asdqwe' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in pyximport (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4495a2909bdab391f460c6671937fa60d164f745657520e43700b229f56faf0a While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

Malicious code in feature-gen-dt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1cb1501cf9b4d2f4476c326f065fbadb057653b09f479cdd836bee84dce76ee1 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-4710 Malicious code in kubernetes.io (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00f207ddd7d4909824d1a01b502b9d29b27380e31b9b410162ed5381de2fae41 The OpenSSF Package Analysis project identified 'kubernetes.io' @ 1.0...

Malicious code in kubernetes.io (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00f207ddd7d4909824d1a01b502b9d29b27380e31b9b410162ed5381de2fae41 The OpenSSF Package Analysis project identified 'kubernetes.io' @ 1.0...

MAL-2025-4733 Malicious code in c2pa-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8983a214dc0d52693f13d8a50f2e5d171641b4b847ce37ea539b48f94971e5e0 Any computer that has this package installed or running should be considered...

SUSE CVE-2025-4638

A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary PCL. This issue may allow context-dependent attackers to cause undefined behavior by exploiting improper pointer arithmetic. Since version 1.14.0, PCL by default uses a zlib...

Security update for docker

This update for docker fixes the following issues: Always clear SUSEConnect suse secrets when starting containers regardless of whether the daemon was built with SUSEConnect support. Not doing this causes containers from SUSEConnect-enabled daemons to fail to start when running with...

PT-2025-23987

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue concerns the behavior of os.OpenFile when the target path is a dangling symlink. On Unix systems, os.OpenFile with O CREATE and O EXCL flags never follows symlinks. However, on...

ASUS DriverHub < 1.0.6.0 Multiple Vulnerabilities

ASUS DriverHub, a driver management tool, installed on the the remote host is a version prior to 1.0.6.0 and, therefore, is affected by multiple vulnerabilities: - An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP...

SUSE: Security Advisory (SUSE-SU-2025:01776-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-4435

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped...

CVE-2025-4435

CVE-2025-4435 affects CPython tarfile: when TarFile.errorlevel=0 and a filter is used, the filter-verified members could be extracted instead of skipped. Root cause described as the extraction filter bypassing for errorlevel=0 in affected versions. Impact per CVSS: HIGH (I) with no availability o...