OPENSUSE-SU-2025:15558-1 element-desktop-1.11.112-1.1 on GA media

These are all security issues fixed in the element-desktop-1.11.112-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15559-1 element-web-1.11.112-1.1 on GA media

These are all security issues fixed in the element-web-1.11.112-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2025-59161

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161 In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161 In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161 In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2025-59161

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

CVE-2023-53298 nfc: fix memory leak of se_io context in nfc_genl_se_io

In the Linux kernel, the following vulnerability has been resolved: nfc: fix memory leak of seio context in nfcgenlseio The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfcgenlseio and supposed to be eventually freed in seiocb callback...

Element Desktop 输入验证错误漏洞

Element Desktop is an Element open source Matrix client for the Element Web-centered desktop platform. An input validation error vulnerability exists in Element Desktop versions prior to 1.11.112, which stems from insufficient validation of the room pre-links and could lead to a remote attacker...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an overlapping expiration traversal issue in nftsetrbtree, which could lead to a memory leak and incorrect eleme...

PT-2025-38059

Name of the Vulnerable Software and Affected Versions Element Web versions prior to 1.11.112 Element Desktop versions prior to 1.11.112 Description Element Web and Element Desktop are susceptible to a room list manipulation issue due to insufficient validation of room predecessor links. A remote...

CVE-2025-59161: Improper Input Validation

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated...

simdjson:fuzz_dump_raw_tape: Use-of-uninitialized-value in std::__1::basic_ostream<char, std::__1::char_traits<char>>& std::__1::__put_char

Detailed Report: https://oss-fuzz.com/testcase?key=6373537834401792 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzdumprawtape Job Type: libfuzzermsansimdjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: std::1::basicostream& std::1::putchar...

simdjson:fuzz_element: Use-of-uninitialized-value in element-inl.h

Detailed Report: https://oss-fuzz.com/testcase?key=5320136975515648 Project: simdjson Fuzzing Engine: libFuzzer Fuzz Target: fuzzelement Job Type: libfuzzermsansimdjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: element-inl.h Sanitizer: memory MSAN...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

PT-2025-39377

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 7 Description A buffer overflow issue exists in MikroTik RouterOS 7. The issue is located in the parse json element function within the libjson.so component, specifically accessible through the /rest/ip/address/print...

GHSA-9MV7-3C64-MMQW xml2rfc is vulnerable to arbitrary file reads through prepped files

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the prepped RFCXML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. References This is related ...

PT-2025-39843

Name of the Vulnerable Software and Affected Versions xml2rfc affected versions not specified Description An issue occurs during the generation of PDF files where an attacker can read arbitrary files from the filesystem. This is achieved by injecting a malicious link element into the prepped...