PT-2025-41123

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0+ Description An integer underflow issue exists in the Linux kernel's mt7601u driver, specifically within the 'mt7601u rx skb from seg' function. This underflow can occur due to manipulation of the dma len...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986696)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986696 advisory. In the Linux kernel, the following vulnerability has been resolved: wl1251: Fix possible buffer overflow in wl1251cmdscan Function wl1251cmdscan calls memcpy without...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414435)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414435 advisory. st21nfcaconnectivityeventreceived in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVTTRANSACTION buffer overflows because of untrusted length...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986280)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986280 advisory. In the Linux kernel, the following vulnerability has been resolved: wl1251: Fix possible buffer overflow in wl1251cmdscan Function wl1251cmdscan calls memcpy without...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986965)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986965 advisory. In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme offset like 0xFFF0...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987230)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987230 advisory. In the Linux kernel, the following vulnerability has been resolved: mac80211: fix skb length check in ieee80211scanrx Replace hard-coded compile-time constants for...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414562)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414562 advisory. In drivers/char/virtioconsole.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf-len value...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-381554)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-381554 advisory. In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdiscpktleninit with UFO After commit 7c6d2ecbda83 net: be mor...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986506 advisory. In the Linux kernel, the following vulnerability has been resolved: media: s5pcec: limit msg.len to CECMAXMSGSIZE I expect that the hardware will have limited this t...

SUSE CVE-2025-39942

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...

SUSE CVE-2025-59730

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

SUSE CVE-2025-59731

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the dwauncompress function when decoding OpenEXR files with DWAA or DWAB compression due to insufficient validation of the raw length of run-length-encoded data. An attacker can cause memory corruption or...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the oldcodec48 process when decoding SANM frames using run-length encoding, as the decoded data may exceed the allocated buffer size. An attacker can cause memory corruption or potentially execute arbitrary code b...

CVE-2025-59731

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

DEBIAN-CVE-2025-59731

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

UBUNTU-CVE-2025-59730

When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution width x height. A buffer of appropriate size is allocated depending on the resolution. This codec can encode the frame...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...

CVE-2025-59731

OpenEXR/FFmpeg CVE-2025-59731 describes a vulnerability in DWAA/DWAB run-length decoding where the rle_raw_size is not checked when calculating output data. The decoder reads rle_raw_size, decompresses into td->rle_raw_data, and may access entries up to (td->xsize-1)*(td->ysize-1) + rle_...

CVE-2025-59731 Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rlerawsize from the input file at 0, we decompress and decode into the buffer td-rlerawdata of size rlerawsize a...