[SECURITY] [DSA 5980-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5980-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 20, 2025 https://www.debian.org/security/faq -...

PT-2025-34102 · Undefined · Undefined

Magix Musik Maker 16 is vulnerable to a stack-based buffer overflow due to improper handling of .mmm arrangement files. The vulnerability arises from an unsafe strcpy operation that fails to validate input length, allowing attackers to overwrite the Structured Exception Handler SEH. By crafting a...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libssh vulnerabilities (USN-7696-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7696-1 advisory. Ronald Crane discovered that libssh incorrectly handled certain base64 conversions. An attacker could use this issue to cause...

CVE-2025-9185

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

CVE-2025-9185 Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

CVE-2025-38585

CVE-2025-38585 concerns Linux kernel staging/atomisp: a stack buffer overflow in gmin_get_var_int() triggered when gmin_get_config_var() calls EFI get_variable() with a larger-than-expected EFI variable. The bug stems from two issues: (1) gmin_get_config_var() returning a stale error code on EFI ...

PT-2025-33873

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 142 Thunderbird versions prior to 142 Description: Memory safety bugs are present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption, and it is presumed that with sufficient...

Linux Distros Unpatched Vulnerability : CVE-2023-42970

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari...

PT-2025-33730 · Unknown · Saurus Cms Community Edition

Name of the Vulnerable Software and Affected Versions: Saurus CMS Community Edition version 4.7.1 Description: Saurus CMS Community Edition 4.7.1 contains an issue in the custom DB::prepare function. The function utilizes preg replace with the deprecated /e eval modifier for SQL query parameter...

UltraVNC < 1.2.2.4 Multiple Vulnerabilities

The version of UltraVNC Service installed on the remote Windows host is prior to 1.2.2.4. It is, therefore, affected by multiple vulnerabilities: - UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution. This...

Mozilla Thunderbird < 128.14

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-71 advisory. - Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox E...

Linux Distros Unpatched Vulnerability : CVE-2024-47540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the...

Security Vulnerabilities fixed in Firefox ESR 128.14 — Mozilla

An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. Same-origin policy bypass in the Graphics: Canvas2D component. Uninitialized memory ...

Mozilla Firefox ESR < 115.27

The version of Firefox ESR installed on the remote Windows host is prior to 115.27. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-65 advisory. - Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,...

Linux Distros Unpatched Vulnerability : CVE-2020-28617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead ...

Linux Distros Unpatched Vulnerability : CVE-2019-5063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause...

Linux Distros Unpatched Vulnerability : CVE-2024-24821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation ...

Linux Distros Unpatched Vulnerability : CVE-2022-22817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could al...

Linux Distros Unpatched Vulnerability : CVE-2022-3775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. ...

CVE-2025-8142 Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'

The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'headerlayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the serve...