Security update for openssh8.4

This update for openssh8.4 fixes the following issues: CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 CVE-2025-61985: Fixed code execution via '\0' character in ssh:// URI when a ProxyCommand is used bsc1251199 Patch Instructions: T...

SUSE-SU-2025:4098-1 Security update for openssh8.4

This update for openssh8.4 fixes the following issues: - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 - CVE-2025-61985: Fixed code execution via '\0' character in ssh:// URI when a ProxyCommand is used bsc1251199...

Security update for openssh

This update for openssh fixes the following issues: CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...

SUSE-SU-2025:4097-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198...

Siemens SIMATIC S7-1500 and Ruggedcom ROX Devices Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2023-29383)

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn change finger. Although it is not possible to exploit this directly e.g., adding a new user fails because \n is in the block list, it is possible to misrepresent the /etc/passwd file when...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-cavs / openssh-clients / etc (SUSE-SU-2025:4067-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4067-1 advisory. - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand i...

Security update for openssh

This update for openssh fixes the following issues: CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 CVE-2025-61985: Fixed code execution via '\0' character in ssh:// URI when a ProxyCommand is used bsc1251199 Patch Instructions: To...

SUSE-SU-2025:4067-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2025-61984: Fixed code execution via control characters in usernames when a ProxyCommand is used bsc1251198 - CVE-2025-61985: Fixed code execution via '\0' character in ssh:// URI when a ProxyCommand is used bsc1251199...

Fujitsu iRMC 安全漏洞

Fujitsu iRMC is an integrated remote management controller from Fujitsu Japan. A security vulnerability exists in the Fujitsu iRMC that stems from improper handling of usernames up to 16 characters in length, which could lead to Redfish/WebUI access issues...

CVE-2025-65002

The vulnerability CVE-2025-65002 affects Fujitsu Fsas Technologies iRMC S6 (M5) prior to version 1.37S. It stems from incorrect authorization (CWE-863) for the Remote Management Controller implemented in PRIMERGY, allowing a user with non-administrator privileges to access the Web UI or Redfish A...

OESA-2025-2646 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH versions prior to 10.1, control characters in user names that originated from certain potentially untrusted sources could lead to code execution when ProxyCommand was used. The potentially untrusted sources include the command line and the %-sequence expansion from a configuration file...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, and 8.4. before 8.4.10, some functions like fsockopen lack validation to ensure that the supplied hostname does not contain null characters. This may cause other functions like parseurl to handle the hostname differently,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectedLanguageId parameter. An attacker can execute arbitrary web scripts or inject HTML by supplying crafted input to this parameter. Details Cross-site scripting or XSS is a code vulnerability that...

OESA-2025-2584 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

OESA-2025-2586 openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. \ It encrypts all traffic to eliminate eavesdropping, connection hijacking, and \ other attacks. In addition, OpenSSH provides a large suite of secure tunneling \ capabilities, several authentication methods, and...

Weak Password Requirements

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Weak Password Requirements due to allowing password strings shorte...

CVE-2025-11232 Invalid characters cause assert

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "^A-Za-z0-9.-"; "hostname-char-replacement" must be empty the default; and "ddns-qualifying-suffix" must NOT be empty the default is empty. DDNS...

ISC KEA -- Invalid characters cause assert

Internet Systems Consortium, Inc. reports: To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "^A-Za-z0-9.-"; "hostname-char-replacement" must be empty the default; and "ddns-qualifying-suffix" must N...

FreeBSD : RT -- CSV injection (b374df95-afa8-11f0-b4c8-792b26d8a051)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b374df95-afa8-11f0-b4c8-792b26d8a051 advisory. Gareth Watkin-Jones from 4armed reports: RT is vulnerable to CSV injection via ticket values with speci...