PT-2025-7054

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2025-01a Description: A vulnerability in the password reset functionality of mailcow allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an...

gcc-toolset-13-gcc security update

13.3.1-2.2.0.1 - Merge Oracle patches to 13.3.1-2.2. Oracle history: November-20-2024 Qing Zhao 13.3.1-2.1.0.1 - gfortran needs install-info at installation time. Orabug: 36472775 13.3.1-2.2 - disable jQuery use, don't ship jquery.js CVE-2020-11023, RHEL-78378...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnvphp: Fixed the hotplug driver crash on Powernv The hotplug driver for powerpc pci/hotplug/pnvphp.c causes a kernel crash when attempting to hot-unplug or disable the PCIe switch/bridge from the PHB. The crash occur...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ila: blocking BH in ilaoutput As explained in commit 1378817486d6 “tipc: blocking BH before using dstcache”, the net/core/dstcache.c helper functions need to be called with blocking BH disabled. ilaoutput is called from...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - spi: rockchip: Fixed improper handling of runtime PM/system PM operations. The commit e882575efc77 “spi: rockchip: Suspend and resume the bus during NOIRQSYSTEMSLEEPPM ops” no longer respects the runtime PM status and simply...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: Fixed the issue where quota root data was leaked after quota disabling failed. If, during quota disabling, we fail to clean the quota tree or delete the root node from the root tree, we jump to the ‘out’ label...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare the clock during runtime suspend/resume If there is any clock controller attached to this I2C bus controller, such as Versaclock or an AIC32x4 I2C codec, then an I2C transfer triggered by th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the f2fsbugon when uninstalling the filesystem, specifically the call to f2fsevict inode. Creating large files during the checkpoint disable period can result in insufficient free segments. When writing back the root...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in the port.c file: the disablestore function may return NULL if the hub to which the port belongs is removed concurrently...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/lima: Fix for shared interrupt handling during driver removal. lima uses a shared interrupt; therefore, the interrupt handlers must be prepared to be called at any time. During driver removal, the clocks are disabled early, a...

SUSE CVE-2024-57949

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in itsirqsetvcpuaffinity The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irqsetvcpuaffinity irqgetdesclock rawspinlockirqsave --- Disable...

PT-2025-6252

Name of the Vulnerable Software and Affected Versions: Distribution versions 3.0.0-beta.1 through 3.0.0-rc.2 Description: The issue lies in how the JSON web key JWK verification is performed. When a JSON web token JWT contains a JWK header without a certificate chain, the code only checks if the...

PT-2025-6192 · WordPress · Geodirectory – Wp Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions up to, and including, 2.8.97 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizati...

PT-2025-18398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the backlight LED driver. The issue occurs when the led sysfs enable function is called without holding the led access...

kernel security update

5.14.0-503.23.25.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2025-6121 · Lumsoft · Lumsoft Erp

Name of the Vulnerable Software and Affected Versions: Lumsoft ERP version 8 Description: A critical issue was found in the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack...

PT-2025-6067 · Unknown +2 · Pam Pkcs11 +2

Name of the Vulnerable Software and Affected Versions: PAM-PKCS11 versions 0.6.12 and prior Description: The issue affects a Linux-PAM login module that allows X.509 certificate-based user login. When a user presses ctrl-c/ctrl-d while being asked for a PIN, the pam pkcs11 module segfaults...

PT-2025-6076 · Unknown · Cool-Admin-Java

Name of the Vulnerable Software and Affected Versions: cool-admin-java version v1.0 Description: A stored cross-site scripting XSS vulnerability in the Parameter List module of cool-admin-java allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the...

PT-2025-6045 · Gnu +1 · Gnu Binutils +1

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.43 Description: A memory leak issue was found in the link order scan function of the ld component, specifically in the file ld/ldelfgen.c. This issue can be exploited remotely, but the complexity of an attack is rather...

PT-2025-6096 · Gnu +3 · Gnu Binutils +3

Name of the Vulnerable Software and Affected Versions: GNU Binutils versions 2.43 through 2.44 Description: A problematic vulnerability was found in GNU Binutils, affecting the bfd set format function of the file format.c. The manipulation leads to memory corruption. The attack can be launched...