CVE-2025-43446

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to modify protected parts of the file system...

CVE-2025-43446

CVE-2025-43446 affects macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1 (and related builds). The issue stems from insufficient validation of symbolic links, enabling an app to modify protected parts of the filesystem. The CVE is mitigated by patches in the listed OS versions (Sono...

PT-2025-45373

Name of the Vulnerable Software and Affected Versions runc versions 1.0.0-rc3 through 1.2.7 runc versions 1.3.0-rc.1 through 1.3.2 runc versions 1.4.0-rc.1 through 1.4.0-rc.2 Description Insufficient checks when bind-mounting /dev/pts/$n to /dev/console inside a container allow an attacker to tri...

PT-2025-45062

Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.44 and below Description Cursor, a code editor for programming with AI, has an issue where NTFS path quirks can be exploited by an attacker to bypass file protections and overwrite files that normally require user...

PT-2025-44880

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An application may be able to modify protected parts of the file system due to insufficient validation of symlinks. The issue was addressed with improved...

kernel security update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: NFS: Fixed a race condition when updating an existing write request. After the nfslockandjoinrequests function checks whether the request is still attached to the mapping, nothing prevents a call to nfs inoderemoverequest from...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sunrpc: Fixing client-side handling of TLS alerts A security exploit was discovered in NFS over TLS in tlsalertrecv. This issue arose due to the assumption that there was valid data within the iterator’s kvec field of the msghdr...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: jfs: Truncating good inode pages when the hard link is 0 The value of the fileset for the inode copy from the disk by the reproducer is AGGRRESERVEDI. When the evict function is executed, its hard link number is 0, so its inode...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: jfs: Validated AG parameters in dbMount to prevent crashes. Validated dbagheight, dbagwidth, and dbagstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. The limits are derived from...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: NFS: Fixed the filehandle bounds checking in nfsfhtodentry. The function needs to check the minimum filehandle length before it can access the embedded filehandle...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fix for the iteration of extrefs during log replay. When calling inodeaddref and processing extrefs, if we jump to the next label, the value of victimname.len is undefined. This occurs because victimname.len wasn’t...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromatwork to prevent NULL dereference In nfs4statestartnet, laundromatwork may access nfsd4sscexpireumount through nfs4laundromat. If nfsd4ssc is not initialized, this can lead to a NULL pointer...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: sunrpc: Fixing the handling of server-side TLS alerts Scott Mayhew discovered a security exploit in NFS over TLS, specifically in the tlsalertrecv function. This exploit stemmed from a misunderstanding by the system that it could...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Fixed a race condition related to waking up the NFSLAYOUTDRAIN task. We identified several systems where tasks were stuck in a writeback state, waiting for the same page lock. Additionally, one task was waiting for th...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: jfs: Upper bound check of the tree index in dbAllocAG When calculating the tree index in dbAllocAG, we never check whether we are out of bounds relative to the size of the tree. This could occur in a scenario where the filesystem...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: NFS: Fixed the setting of capabilities when automatically mounting a new filesystem. Capabilities cannot be inherited when crossing into a new filesystem. They need to be reset to their minimum defaults, and then checked again...

Astra Linux - Vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self-recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently attempts to replay the local journal to restore the filesystem to a consistent state. Not...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the issue where foreground garbage collection might be triggered during f2fsmapblocks in lfs mode. The issue occurs when the “mode=lfs” mount option is used; in this case, generic/299 will cause a system panic. Cut he...

USN-7835-4 linux-hwe-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - ACPI drivers; - Ublk userspace block driver; -...