CVE-2018-9474

In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-27733

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.12.0 Description: A null pointer dereference issue was discovered in the Linux kernel, specifically in the txopt get function. This issue occurs when the netlbl conn setattr function is called without proper...

CVE-2006-3418

Tor before 0.1.1.20 does not validate that a server descriptor's fingerprint line matches its identity key, which allows remote attackers to spoof the fingerprint line, which might be trusted by users or other applications...

CVE-2025-47939 TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer

TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restrictio...

Panasonic IR Control Hub vulnerable to Unauthorised firmware loading

Overview IR Control Hub provided by Panasonic contains a vulnerability that may lead to loading of unauthorized firmware. IR Control Hub provided by Panasonic verifies the hash value of the loading firmware when booting, but it keeps booting with the firmware even when it detects that the hash...

xorg: xwayland: Heap overflow in XkbWriteKeySyms()

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms differs from what is written in XkbWriteKeySyms, which may lead to a heap-based buffer overflow...

openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected

A flaw was found in OpenSSL's RFC7250 Raw Public Key RPK authentication. This vulnerability allows man-in-the-middle MITM attacks via failure to abort TLS/DTLS handshakes when the server's RPK does not match the expected key despite the SSLVERIFYPEER verification mode being set...

DEBIAN-CVE-2025-37876

In the Linux kernel, the following vulnerability has been resolved: netfs: Only create /proc/fs/netfs with CONFIGPROCFS When testing a special config: CONFIGNETFSSUPPORTS=y CONFIGPROCFS=n The system crashes with something like: 3.766197 ------------ cut here ------------ 3.766484 kernel BUG at...

DEBIAN-CVE-2025-37827

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in btrfsaddfreespacezoned that ultimately happens because a conversion from the default metadata profile...

UBUNTU-CVE-2025-37827

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in btrfsaddfreespacezoned that ultimately happens because a conversion from the default metadata profile...

CVE-2025-37827 btrfs: zoned: return EIO on RAID1 block group write pointer mismatch

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: return EIO on RAID1 block group write pointer mismatch There was a bug report about a NULL pointer dereference in btrfsaddfreespacezoned that ultimately happens because a conversion from the default metadata profile...

GHSA-72QJ-48G4-5XGX JRuby-OpenSSL has hostname verification disabled by default

Summary When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't complain. Details n/a...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the SSL certificate validation process. An attacker can intercept secure communications by presenting a valid certificate for an unrelated domain that the attacker controls. Note:...

Improper Validation of Certificate with Host Mismatch

Overview org.jruby:jruby is a high performance, stable, fully threaded Java implementation of the Ruby programming language. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the SSL certificate validation process. An attacker can interce...

The vulnerability of the Arrays.equals() method in the Apache Hive database, which allows an attacker to cause a service failure.

The vulnerability of the Arrays.equals method in the Apache Hive database is related to manipulating unknown inputs, which leads to a timing mismatch vulnerability. Exploiting this vulnerability could allow an attacker to cause service failures...

qemu-kvm security update

9.0.0-10.el95.3 - kvm-target-i386-fix-feature-dependency-for-WAITPKG.patch RHEL-84866 - Resolves: RHEL-84866 Live migration after workload update fails with operation failed: guest CPU doesn't match specification: missing features: waitpkg rhel-9.5.z...

DEBIAN-CVE-2023-53062

In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc95xx: Limit packet length to skb-len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory conten...

PT-2025-18894 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A issue in the Linux kernel has been identified where the disk scan partitions function is called with 'FMODE EXCL', but blkdev get by dev is called without 'FMODE EXCL'. As a result,...

Failed to load module [veeamblksnap] on Oracle Linux 9 with UEK R8 kernel

Article Applicability This article is specifically regarding Oracle Linux 9 with UEK R8 kernel 6.12+: root@localhost cat /etc/os-release PRETTYNAME="Oracle Linux Server 9.5" root@localhost uname -r 6.12.0-0.20.20.el9uek.x8664 For all other situations involving the error "Failed to load module...

CVE-2022-49789

In the Linux kernel, the following vulnerability has been resolved: scsi: zfcp: Fix double free of FSF request when qdio send fails We used to use the wrong type of integer in 'zfcpfsfreqsend' to cache the FSF request ID when sending a new FSF request. This is used in case the sending fails and w...