MAL-2025-17953 Malicious code in dandelion-rose-xhe828-project (npm)

The package dandelion-rose-xhe828-project was found to contain malicious code...

MAL-2025-32453 Malicious code in rose-opal-sya256-project (npm)

The package rose-opal-sya256-project was found to contain malicious code...

MAL-2025-33618 Malicious code in solace-qxoli-6mtci-rose-project (npm)

The package solace-qxoli-6mtci-rose-project was found to contain malicious code...

MAL-2025-14570 Malicious code in ant-rose-klv704-project (npm)

The package ant-rose-klv704-project was found to contain malicious code...

MAL-2025-31989 Malicious code in reef-rose-rfe604-project (npm)

The package reef-rose-rfe604-project was found to contain malicious code...

MAL-2025-32448 Malicious code in rose-kaleidoscope-fbg917-project (npm)

The package rose-kaleidoscope-fbg917-project was found to contain malicious code...

MAL-2025-16277 Malicious code in buffalo-rose-jzs105-project (npm)

The package buffalo-rose-jzs105-project was found to contain malicious code...

MAL-2025-32442 Malicious code in rose-bttvf-85j11-frost-project (npm)

The package rose-bttvf-85j11-frost-project was found to contain malicious code...

MAL-2025-24910 Malicious code in lagoon-rose-gpy887-project (npm)

The package lagoon-rose-gpy887-project was found to contain malicious code...

MAL-2025-32446 Malicious code in rose-ehpcl-0rkjr-twilight-project (npm)

The package rose-ehpcl-0rkjr-twilight-project was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2022-2318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any...

DEBIAN-CVE-2025-38377

In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rosertdevicedown There are two bugs in rosertdevicedown that can cause use-after-free: 1. The loop bound t-count is modified within the loop, which can cause the loop to terminate early an...

UBUNTU-CVE-2025-38377

In the Linux kernel, the following vulnerability has been resolved: rose: fix dangling neighbour pointers in rosertdevicedown There are two bugs in rosertdevicedown that can cause use-after-free: 1. The loop bound t-count is modified within the loop, which can cause the loop to terminate early an...

USN-7651-6 linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

USN-7651-5 linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

CVE-2022-50163 ax25: fix incorrect dev_tracker usage

In the Linux kernel, the following vulnerability has been resolved: ax25: fix incorrect devtracker usage While investigating a separate rose issue 1, and enabling CONFIGNETDEVREFCNTTRACKER=y, Bernard reported an orthogonal ax25 issue 2 An ax25dev can be used by one or many struct ax25cb. We thus...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/rose: integer overflows can occur when using rosesetsockopt with potentially excessively large arguments, along with additional values being applied to them. To mitigate this issue, perform the following actions as a minimum...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - net: rose: locking the socket in rosebind - syzbot reported a soft lockup in roseloopbacktimer, with repro calls to bind from multiple threads. RoseBind must lock the socket to avoid this issue...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: rose: Fix for timer race conditions against user threads. The Rose timers only acquire the socket spinlock, without checking whether the socket is owned by a specific user thread. Add a check and reinitialize the timers i...

Malicious code in rose-web3-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e7bba39177d14d11698b3ccaeca36599df068894146efc99d0ded173449d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...