December 9, 2025—KB5071417 (OS Build 22631.6345)

None None...

November 11, 2025—KB5068861 (OS Builds 26200.7171 and 26100.7171)

None None...

CVE-2023-53819 amdgpu: validate offset_in_bo of drm_amdgpu_gem_va

In the Linux kernel, the following vulnerability has been resolved: amdgpu: validate offsetinbo of drmamdgpugemva This is motivated by OOB access in amdgpuvmupdaterange when offsetinbo+mapsize overflows. v2: keep the validations in amdgpuvmbomap v3: add the validations to...

Fedora 42 : imhex / lunasvg (2025-9b6b49071f)

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-9b6b49071f advisory. - Unbundle plutovg from lunasvg, this avoids shipping a duplicate library with conflicting files. - Update lunasvg to consume the plutovg version...

OPENSUSE-SU-2025:15805-1 python311-Django-5.2.9-1.1 on GA media

These are all security issues fixed in the python311-Django-5.2.9-1.1 package on the GA media of openSUSE Tumbleweed...

Siemens Building X - Security Manager Edge Controller

SUMMARY Building X - Security Manager Edge Controller ACC-AP devices do not properly check the integrity of firmware updates. This could allow an attacker to upload a maliciously modified firmware onto the device. Siemens is preparing fix versions and recommends specific countermeasures for...

OPENSUSE-SU-2025:15806-1 python311-Django4-4.2.27-1.1 on GA media

These are all security issues fixed in the python311-Django4-4.2.27-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15803-1 krb5-1.22.1-1.1 on GA media

These are all security issues fixed in the krb5-1.22.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15807-1 regclient-0.11.1-1.1 on GA media

These are all security issues fixed in the regclient-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

.NET 10.0 Update - December 9, 2025 (KB5072928)

None None...

A week in security (December 1 – December 7)

Last week on Malwarebytes Labs: Leaks show Intellexa burning zero-days to keep Predator spyware running How scammers use fake insurance texts to steal your identity Canadian police trialing facial recognition bodycams Update Chrome now: Google fixes 13 security issues affecting billions Attackers...

OPENSUSE-SU-2025:15801-1 libpng16-16-1.6.52-1.1 on GA media

These are all security issues fixed in the libpng16-16-1.6.52-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE 16 Security Update : chromium (openSUSE-SU-2025-20140-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20140-1 advisory. Changes in chromium: Chromium 143.0.7499.40 boo1254429: CVE-2025-13630: Type Confusion in V8 CVE-2025-13631: Inappropriate implementation in...

kernel security update

4.18.0-553.89.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Oracle Linux 10 : kernel (ELSA-2025-21931)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21931 advisory. - fs/smb: Fix inconsistent refcnt update Paulo Alcantara RHEL-124955 CVE-2025-39819 - tcp: Clear tcpsksk-fastopenrsk in tcpdisconnect. Antoine Tenart...

FreeBSD : chromium -- multiple security fixes (ea34264d-d289-11f0-a15a-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ea34264d-d289-11f0-a15a-a8a1599412c6 advisory. Chrome Releases reports: This update includes 13 security fixes: Tenable has extracted the...

OPENSUSE-SU-2025:15800-1 kdeconnect-kde-25.11.90-1.1 on GA media

These are all security issues fixed in the kdeconnect-kde-25.11.90-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-66515

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerabilit...

EUVD-2025-201461

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...

CVE-2025-66554 Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...