Use After Free

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code execution...

CVE-2025-36853

A vulnerability CVE-2025-21172 exists in msdia140.dll due to integer overflow and heap-based overflow. Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning th...

CVE-2025-36854

A vulnerability CVE-2024-38229 https://www.cve.org/CVERecord exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution. Per CWE-416: Use After Free...

CVE-2025-36855 EOL .NET 6.0 Runtime Remote Code Execution Vulnerability

...

CVE-2025-36855 EOL .NET 6.0 Runtime Remote Code Execution Vulnerability

...

CVE-2025-36855

CVE-2025-36855 concerns a buffer over-read in DiaSymReader.dll and affects End-Of-Life .NET components. The issue applies to EOL ASP.NET 6.0.0–6.0.36 and to .NET runtimes in the CVE-2025-21176 family (8.0.0–8.0.11 and 9.0.0–9.0.0). Self-contained deployments targeting affected versions are also v...

CVE-2025-36854 EOL ASP.NET 6.0 Remote Code Execution Vulnerability

...

CVE-2025-36854 EOL ASP.NET 6.0 Remote Code Execution Vulnerability

...

CVE-2025-36854

CVE-2025-36854 concerns an RCE in EOL ASP.NET caused by a race condition when closing an HTTP/3 stream while response data is still being written, leading to use-after-free. Affected are EOL ASP.NET 6.0.0–6.0.36, 8.0.0–8.0.8, and 9.0.0-preview.1.24081.5–9.0.0.RC.1; self-contained deployments are ...

CVE-2025-36853 EOL .NET 6.0 Runtime Remote Code Execution Vulnerability

...

CVE-2025-36853 EOL .NET 6.0 Runtime Remote Code Execution Vulnerability

...

CVE-2025-36853

CVE-2025-36853 maps to CVE-2025-21172 and involves a root cause of integer overflow and heap-based overflow in msdia140.dll. The EU/CNNVD references attribute this to Microsoft .NET/Visual Studio, with CVSS v3.1 base score 7.5 (Network, High impact across confidentiality, integrity, availability;...

PT-2025-36468

Name of the Vulnerable Software and Affected Versions: EOL ASP.NET versions 6.0.0 through 6.0.36 EOL ASP.NET versions 8.0.0 through 8.0.8 EOL ASP.NET versions 9.0.0-preview.1.24081.5 through 9.0.0.RC.1 Description: A race condition may occur when closing an HTTP/3 stream while application code is...

PT-2025-36469

Name of the Vulnerable Software and Affected Versions: .NET 6.0.0 through 6.0.36 .NET 8.0.0 through 8.0.11 .NET 9.0.0 Description: A buffer over-read issue exists in DiaSymReader.dll. This occurs when a product reads from a buffer using buffer access mechanisms that reference memory locations aft...

PT-2025-36467

Name of the Vulnerable Software and Affected Versions: msdia140.dll affected versions not specified Description: The software contains a heap-based buffer overflow condition, where a buffer allocated in the heap portion of memory can be overwritten. Additionally, an integer overflow or wraparound...

Friday Squid Blogging: The Origin and Propagation of Squid

New research paywalled: Editor 's summary: Cephalopods are one of the most successful marine invertebrates in modern oceans, and they have a 500-million-year-old history. However, we know very little about their evolution because soft-bodied animals rarely fossilize. Ikegami et al. developed an...

CVE-2025-57807

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob, which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob, which then expan...

DEBIAN-CVE-2025-39691

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bhread helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in endbufferreadsync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm...

AZL-73710 CVE-2025-39691 affecting package kernel for versions less than 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bhread helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in endbufferreadsync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm...

UBUNTU-CVE-2025-39691

In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bhread helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in endbufferreadsync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm...