248 matches found
`zvariant_derive` is unmaintained
The zvariantderive crate is no longer maintained as a standalone crate. Its derive macros are provided by zbus starting with version 6.0.0. Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format...
PT-2026-125047
The zvariant derive crate is no longer maintained as a standalone crate. Its derive macros are provided by zbus starting with version 6.0.0. Users should migrate to zbus, with its default features disabled if they only need the D-Bus wire format...
Astra Linux – Vulnerability in libde265
It was discovered that Libde265 v1.0.14 contains a heap buffer overflow vulnerability in the derivespatiallumavectorprediction function at motion.cc...
Astra Linux – Vulnerability in Firefox
The NSCDeriveKey function inadvertently assumed that the phKey parameter was always non-NULL. When the parameter was passed as NULL, a segmentation fault occurred, resulting in crashes. This behavior conflicts with the PKCS11 v3.0 specification, which allows phKey to be NULL for certain mechanism...
Malicious code in wallet-hd-derive (RubyGems)
Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install auto-executes it. extconf.rb decodes a base64-encoded Ruby...
Malicious Package
Overview wallet-hd-derive is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in wallet-hd-derive (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...
MAL-2026-17800 Malicious code in wallet-hd-derive (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...
Malicious code in hdkey-derive-helper (RubyGems)
Source: amazon-inspector 04f5409730ece37713b6a8d3afddcce30744e213b80759f7ae89478731b0264a The gem presents itself as a BIP32/mnemonic derivation helper but ships only a wordlist stub and a 56-byte empty C file ext/hdkey-derive-helper/hdkey-derive-helper.c, body void InitHdkeyDeriveHelpervoid...
Malicious Package
Overview hdkey-derive-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in hdkey-derive-helper (RubyGems)
RubyGems runs this gem's native extension script ext/hdkey-derive-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...
MAL-2026-17602 Malicious code in hdkey-derive-helper (RubyGems)
RubyGems runs this gem's native extension script ext/hdkey-derive-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...
OpenSSL derive() function Data Compromise
The vulnerability of the derive function in the modules openssl/src/derive.rs and openssl/src/pkeyctx.rs of the OpenSSL library is related to an incorrect calculation of the buffer size. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...
JLSEC-2026-1142 Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer...
Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r a small prime factor of the cofacto...
Security update for s390-tools
This update for s390-tools fixes the following issue CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270185. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...
Security update for s390-tools
This update for s390-tools fixes the following issue CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270185. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...
p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing
A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...
Security update for sccache
This update for sccache fixes the following issues: Update to version 0.15.017. CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes HTTP2 RSTSTREAM frames bsc1210346. CVE-2024-32650: rust-rustls: infinite loop in...
MAL-2026-10611 Malicious code in @web3-helpers/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225 At npm install time the preinstall script dist/index.min.js reads installer-owned secrets — /.ssh/idrsa, /.env, /.env.local, /.wallet.json — and...
SUSE-SU-2026:2977-1 Security update for afterburn
This update for afterburn fixes the following issues Update to version 5.10.0.git73.b97f772. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270175. - CVE-2026-41677: openssl: out-of-bounds read in PEM password...