CVE-2023-53777

CVE-2023-53777 affects the Linux kernel’s EROFS subsystem, specifically when using data-deduplicated compressed images. A race can form looping chains (hooked chains) between pclusters, potentially causing file pages to remain locked forever. The vulnerability description confirms it is observed ...

CVE-2023-53777 erofs: kill hooked chains to avoid loops on deduplicated compressed images

In the Linux kernel, the following vulnerability has been resolved: erofs: kill hooked chains to avoid loops on deduplicated compressed images After heavily stressing EROFS with several images which include a hand-crafted image of repeated patterns for more than 46 days, I found two chains could ...

CLSA-2025-1764026530 qt5-qtbase: Fix of CVE-2023-38197

CVE-2023-38197: fix infinite loops in recursive entity expansion...

CLSA-2025-1763716672 edk2: Fix of 7 CVEs

CVE-2023-45229: fix IPv6 malformed option handling to prevent parsing loop - CVE-2023-45230: fix DHCPv6 ServerID length validation to prevent buffer overflow - CVE-2023-45231: fix IPv6 Redirect bounds checks to avoid out-of-bounds access - CVE-2023-45232: fix IPv6 destination option parsing to...

Siemens SIMATIC S7-1500 Excessive Platform Resource Consumption within a Loop (CVE-2024-39469)

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfsemptydir misjudgment and long loop on I/O errors The error handling in nilfsemptydir when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or...

MAL-2025-185230 Malicious code in soniec-kat-faveri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e29092ec5a62917a41409dd508ccbaea3fef39e4ac3dbfcc23f6e9c5f2ae0bab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183660 Malicious code in mahnu-oy-gisostsio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245800ff90c2f22b0478cdd48b2c7e0899423a67d912520bddc6ada569a23113 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lintang-tea2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83b9697f242593bf013475e10beecff219deb22e8fdcea397472256e8d52cd74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in goodmanmax9250-strange-route (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f15b103b79b0dd7fb98f8361d4bad68091eb22e7e0c760a68ace301860a83d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156556 Malicious code in intan-46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b86d252e471bbccc19506f1f8a4c137ffc2963ab9d2eaa35d9633adf085d77f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169579 Malicious code in uarfug-mitauhi-sufeua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9361397ba1176f3a9008451517bbac6ad3c8fd39369d3341ce46c4a7012037ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aben-poke39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4798665b638d60fa8f41e3fe7875d6fbe117c5fb32f0fc337f20ca9d506fa188 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168359 Malicious code in tealove-lady50 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19207635e48c0996f6d61ffc8732a28224cd8b39b08f44e8d0bdd184b1913336 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uaragia-mudafsituhai-suf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96459c83c4c0f78a52ea77147ae2f74ea40b288a6c7cf3fada0f1251eeb2a8c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nudalea-ofofiari-agua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c102ebd82fbb48675de94a56b993d94327841c9af5fe0979592a803752becb55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157791 Malicious code in kuinsu-lukoki-nbtabi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060ac6d713ff926246f0757aa633cf7c1857e203eb5ccacefbc302b901619071 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149828 Malicious code in yonder-acamar-terser-webpack-plugin-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d67598092c99278899708ccaf956db5b784f63e8cf0fea187c25b581869382a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147677 Malicious code in sass-loader-mui-library-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e74a0f0b1190b28e62b75438426908b78b6776a7293dc127d4f7f037d74279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144074 Malicious code in jwt-ganymede-meissa-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa0c01666a92cdf3398dba5ae53b375ce14478ed631928b37880ba1eea55e208 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-pecel90-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c0ef5a21b064a0fed14496e56a8f0853918310a05ef29e86e122e698ba91813 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...