Security update for podman

This update for podman fixes the following issues: CVE-2025-6032: Machine init command fails to verify TLS certificate when downloading VM images from an OCI registry bsc1245320. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate o...

kernel: drm/vkms: Fix use after free and double free on init error

In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkmsexit function might access an uninitialized or freed defaultconfig pointer and it might double free it. Fix both possible erro...

The vulnerability of the Cloud-Init initialization tool, related to deficiencies in the authentication process, allows a perpetrator to elevate their privileges to the root level.

The vulnerability of the Cloud-Init initialization tool is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to elevate their privileges to root access for a strictly encrypted URL with a local IP address...

Medium: libssh

Issue Overview: The privatekeyfromfile uses an uninitialized variable under certain conditions, such as if the file specified by the filename argument doesn't exist. This causes the code to return an invalid private key. This defect, in turn, might cause signing failure. The bug might also cause ...

CVE-2025-39729

CVE-2025-39729 affects the Linux kernel crypto CCP implementation. The issue arises from dereferencing an uninitialized error pointer in sev-dev.c:1312, previously allowing an assumption that the variable could be NULL and leading to a potential crash or instability. The vulnerability was address...

CVE-2025-26419

In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Exploit for Improper Initialization in Linux Linux_Kernel

This is a PoC exploit for the Dirty Pipe vulnerability CVE-2022-0847 on Android, specifically targeting Pixel 6 devices with a security patch level from 2022-02-05 to 2022-04-05. The exploit is designed to overwrite readable files and can't overwrite the first byte of each page each 4096 bytes. I...

DEBIAN-CVE-2025-39681

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrlcpudetect in bspinit helper Since 923f3a2b48bd "x86/resctrl: Query LLC monitoring properties once during boot" resctrlcpudetect has been moved from common CPU initialization code to the...

CVE-2025-39681

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrlcpudetect in bspinit helper Since 923f3a2b48bd "x86/resctrl: Query LLC monitoring properties once during boot" resctrlcpudetect has been moved from common CPU initialization code to the...

AZL-67043 CVE-2025-39681 affecting package kernel for versions less than 6.6.104.2-1

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrlcpudetect in bspinit helper Since 923f3a2b48bd "x86/resctrl: Query LLC monitoring properties once during boot" resctrlcpudetect has been moved from common CPU initialization code to the...

CVE-2025-38737

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3inittransformrq to initialise buffer to NULL before calling netfsallocfolioqbuffer as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should...

DEBIAN-CVE-2025-38737

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3inittransformrq to initialise buffer to NULL before calling netfsallocfolioqbuffer as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should...

CVE-2025-39681

CVE-2025-39681 relates to the Linux kernel on x86 with Hygon CPUs. The root cause was a missing resctrl_cpu_detect() call in the Hygon BSP init path after resctrl_cpu_detect() was moved to vendor-specific init code. This caused a division-by-zero in get_rdt_mon_resources() during early boot due t...

CVE-2025-38737

CVE-2025-38737 affects the Linux kernel CIFS/smb3 code. The issue is a crash (an oops) caused by an uninitialised variable in smb3_init_transform_rq(), where netfs_alloc_folioq_buffer() is called with an undefined buffer. The fix initialises the buffer to NULL before the call so that netfs starts...

Malicious code in eigenstate-parallax-init-miranda (npm)

The package eigenstate-parallax-init-miranda was found to contain malicious code...

Malicious code in kronos-init-carpo-transform (npm)

The package kronos-init-carpo-transform was found to contain malicious code...

MAL-2025-43541 Malicious code in australis-neptunology-eslint-init (npm)

The package australis-neptunology-eslint-init was found to contain malicious code...

MAL-2025-44902 Malicious code in kronos-init-carpo-transform (npm)

The package kronos-init-carpo-transform was found to contain malicious code...

SUSE-SU-2025:20656-1 Security update for cloud-init

This update for cloud-init fixes the following issues: Update to version 25.1.3: - CVE-2024-6174: Unpriveleged user could trigger hotplug-hook commands bsc1245403. None security fixes: - Rebase cloud-init to 24.4 or higher bsc1239715, jscPED-8680. - Fixed cloud-init --debug status bsc1228414. -...

Security update for cloud-init

This update for cloud-init fixes the following issues: Update to version 25.1.3: CVE-2024-6174: Unpriveleged user could trigger hotplug-hook commands bsc1245403. None security fixes: Rebase cloud-init to 24.4 or higher bsc1239715, jscPED-8680. Fixed cloud-init --debug status bsc1228414. Using...