MAL-2026-2244 Malicious code in fluxhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2669b72303bd592ba1633febc04bca1f0a8804d8546baf21b5f3f12baaa80f29 Malicious clone of a legitimate package. When using it, the code attempts to download and execute remote code. In on of the incarnations, the malicious code wa...

MAL-2026-2119 Malicious code in apachelicense (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9d96d45a87e117e72107d6d6dfbe8c4e94323323bc28ce9accd8ccba39a0a46c Malicious clone of legitimate "license" package. When using the findbykey function, the malicious code from strongly obfuscated files is loaded. It then at lea...

[SECURITY] Fedora 42 Update: perl-Crypt-SysRandom-XS-0.011-1.fc42

This module uses whatever C interface is available to procure cryptographically random data from the system...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38575)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38575 advisory. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match...

ndpi:fuzz_quic_get_crypto_data: Use-of-uninitialized-value in ndpi_is_valid_hostname

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=5067137556480000 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzquicgetcryptodata Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

ndpi:fuzz_quic_get_crypto_data: Heap-buffer-overflow in ndpi_is_valid_hostname

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=4707178494885888 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzquicgetcryptodata Job Type: libfuzzerasanndpi Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Malicious code in backtradingbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 117c24f5b7a0f5e4921e4478231a717ecca01748a5b266d8984e619f06173984 Running the installed entry point downloads and executes remote code. During the analysis, the code was switching to websockets, adding a startup script and...

SUSE CVE-2025-38575

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

DEBIAN-CVE-2025-38575

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

CVE-2025-38575

In CVE-2025-38575, the Linux kernel ksmbd memory handling was corrected: memory allocated by aead_request_alloc() must be freed with aead_request_free() to ensure sensitive crypto data is zeroed before freeing. This resolves a local-attack surface (AV:L/AC:L/PR:L/UI:N/S:U) with a MEDIUM base scor...

CVE-2025-38575 ksmbd: use aead_request_free to match aead_request_alloc

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

CVE-2025-38575: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aeadrequestfree to match aeadrequestalloc Use aeadrequestfree instead of kfree to properly free memory allocated by aeadrequestalloc. This ensures sensitive crypto data is zeroed before being freed...

CVE-2024-8612 Qemu-kvm: information leak in virtio devices

A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueuepush as set in virtioscsicompletereq / virtioblkreqcomplete / viritocryptoreqcomplete could be larger than the true size of the data which has been sent to guest. Once virtqueuepush finally...