SUSE-SU-2025:4123-1 Security update for the Linux Kernel (Live Patch 61 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise kernel 4.12.14-122.231 fixes various security issues The following security issues were fixed: - CVE-2022-48956: ipv6: avoid use-after-free in ip6fragment bsc1232637. - CVE-2022-49014: net: tun: Fix use-after-free in tundetach bsc1232818. - CVE-2022-49053...

itextpdf-5.5.13.4-1.1 on GA media (moderate)

itextpdf-5.5.13.4-1.1 on GA media Announcement ID: openSUSE-SU-2025:15739-1 Rating: moderate Cross-References: CVE-2024-29857 CVSS scores: CVE-2024-29857 SUSE : 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now ...

PT-2025-47312

Name of the Vulnerable Software and Affected Versions Windu CMS version 4.1 Windu CMS affected versions not specified Description Windu CMS is susceptible to a Cross-Site Request Forgery CSRF issue within its file uploading functionality. A malicious actor can create a specially crafted website...

PT-2025-47414

Name of the Vulnerable Software and Affected Versions Emby Server versions prior to 4.8.1.0 Emby Server versions prior to 4.9.0.0-beta Description Emby Server is a personal media server. A malicious user can send an authentication request with a manipulated X-Emby-Client value. This value is adde...

CVE-2025-64766 NixOS has hardcoded credentials in Onlyoffice module

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protec...

EUVD-2025-197878

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protec...

CVE-2025-64766 NixOS has hardcoded credentials in Onlyoffice module

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protec...

CLSA-2025-1763388821 squid34: Fix of CVE-2025-62168

CVE-2025-62168: Redact HTTP authentication credentials in error handling to prevent information disclosure...

Critical: Red Hat Security Advisory: lasso security update

An update for lasso is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Critical: lasso security update

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fixes: lasso: Type...

Updated apache-commons-beanutils packages fix security vulnerability

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default. CVE-2025-48734...

CVE-2025-7000

An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests...

CVE-2025-40081 affecting package kernel for versions less than 6.6.112.1-2

CVE-2025-40081 affecting package kernel for versions less than 6.6.112.1-2. An upgraded version of the package is available that resolves this issue...

CLSA-2025-1763141692 udisks2: Fix of CVE-2025-8067

CVE-2025-8067: fix issue allowing unprivileged users to create loop devices with negative index values...

CLSA-2025-1763123915 udisks2: Fix of CVE-2025-8067

CVE-2025-8067: fix issue allowing unprivileged users to create loop devices by validating lower bound of index parameter in loop device handler function...

OESA-2025-2688 luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. Some projects need to store additional metadata about a LUKS volume that is accessable before unlocking it. Fortunately, there is a gap in the LUKS header between the end of the slot area and the payload offset, LUKSMeta uses...

OESA-2025-2689 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: The Keras.Model.loadmodel method, including when executed with the intended security mitigation safemode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery SSRF. This vulnerability stems from th...

OESA-2025-2683 python-ldap security update

python-ldap: python-ldap provides an object-oriented API to access LDAP directory servers from Python programs. Mainly it wraps the OpenLDAP 2.x libs for that purpose. Additionally the package contains modules for other LDAP-related stuff e.g. processing LDIF, LDAPURLs, LDAPv3 schema, LDAPv3...

OESA-2025-2675 python-aiomysql security update

aiomysql is a "driver" for accessing a MySQL database from the asyncio PEP-3156/tulip framework. It depends on and reuses most parts of PyMySQL . aiomysql tries to be like awesome aiopg library and preserve same api, look and feel. Security Fixes: aiomysql is a library for accessing a MySQL...

OESA-2025-2672 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML...