[SECURITY] [DLA 4467-1] containerd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4467-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout February 05, 2026 https://wiki.debian.org/LTS -...

IBM App Connect Enterprise Certified Container 代码问题漏洞

IBM App Connect Enterprise Certified Container is an image based on the IBM App Connect Enterprise software product from International Business Machines IBM. The software package is provided as an executable file and can be deployed and run in a containerized environment. There are code...

Debian dla-4468 : libtomcat9-embed-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4468 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4468-1 [email protected]...

PT-2026-6556

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise Certified Container versions up to 12.19.0 Continuous Delivery IBM App Connect Enterprise Certified Container version 12.0 LTS Long Term Support Description The software may allow an attacker to access sensitive file...

PT-2026-6550

Name of the Vulnerable Software and Affected Versions iomad versions prior to 4.5 LTS iomad versions prior to 5.0 Description A flaw exists in iomad that allows for remote execution of SQL injection attacks. The issue resides within an unknown function of the Company Admin Block component...

Debian dla-4467 : containerd - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4467 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4467-1 [email protected]...

Debian dla-4469 : libasound2 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4469 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4469-1 [email protected] https://www.debian.org/lts/security/...

EVE Has Partially Predetermined Vault Key

Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys 16 bytes from each, the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access...

EVE Doesn't Protect Rootfs

Impact Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote...

EVE Seals Vault Key With SHA1 PCRs

Impact The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content. Patches Fixed in 9.4.3-lts and 10.1.0 Workarounds N...

EVE Doesn't Measure Config Partition From 2 Fronts

Impact PCR14 is not included in the list of PCRs that seal/unseal the vault key. Additionally, the vault key uses SHA1 PCRs instead of SHA256. Thus an attacker with physical access can take out the disk, use a different computer to modify the files in the /config partition, and re-insert the disk...

PT-2026-6495

Impact Config partition measurement was moved from PCR 13 to PCR 14 in a commit, but PCR 14 was not added to the list of PCRs that seal/unseal the vault key. As a result, an attacker can remove the disk, use another server to modify the files in the config partition, and then re-insert the disk...

PT-2026-6354

Impact On boot, the Pillar container checks for /config/authorized keys. If present with a valid public key, it enables SSH on port 22 with root login. The /config partition is not protected by measured boot, is mutable and unencrypted. This enables an attacker with physical access to the device ...

PT-2026-6461

Impact PCR14 is not included in the list of PCRs that seal/unseal the vault key. Additionally, the vault key uses SHA1 PCRs instead of SHA256. Thus an attacker with physical access can take out the disk, use a different computer to modify the files in the /config partition, and re-insert the disk...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FreeRDP vulnerabilities (USN-8004-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8004-1 advisory. Kim Dong Han discovered that FreeRDP did not correctly validate the size of certain variables, which could cause a...

Ubuntu 24.04 LTS : libpng vulnerabilities (USN-7993-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7993-1 advisory. It was discovered that libpng incorrectly handled memory when processing certain malformed PNG files. If a user or automated system were tricked into...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : OpenJDK 21 vulnerabilities (USN-8002-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8002-1 advisory. It was discovered that the RMI component of OpenJDK 21 would establish RMI TCP endpoint connections to a remote host...

Information Exposure

Overview openmage/magento-lts is a This repository is the home of an unofficial community-driven project. Affected versions of this package are vulnerable to Information Exposure via the X-Original-Url header. An attacker can obtain sensitive information about the administrative interface locatio...

Debian dla-4464 : xrdp - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4464 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4464-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DLA 4462-1] pillow security update

Debian LTS Advisory DLA-4462-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert February 01, 2026 https://wiki.debian.org/LTS Package : pillow Version : 8.1.2+dfsg-0.3+deb11u3 CVE ID : CVE-2021-23437 CVE-2022-24303 CVE-2022-45198 Multiple vulnerabilities have been...