SUSE-SU-2025:02132-1 Security update for the Linux Kernel (Live Patch 63 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122237 fixes several issues. The following security issues were fixed: - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. - CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2capsockcreat...

Security update for the Linux Kernel (Live Patch 58 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122222 fixes several issues. The following security issues were fixed: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708...

CVE-2025-5459

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0...

CVE-2025-2938

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval...

RHEL 8 : osbuild-composer (RHSA-2025:9713)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9713 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

RHEL 9 : .NET 9.0 (RHSA-2025:8817)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8817 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. N...

RHEL 10 : .NET 8.0 (RHSA-2025:8814)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8814 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation...

RHEL 10 : kernel (RHSA-2025:8669)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8669 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: vsock/virtio: discard packets...

RHEL 9 : nodejs:20 (RHSA-2025:8902)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8902 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes...

RHEL 8 : grafana (RHSA-2025:8679)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8679 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Cross-site...

CVE-2025-52893

OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. Affected software: OpenBao (open-source data management for secrets, certificates, keys). Root cause: log disclosure vulnerability due to handling of malformed input. Impact: potential exposure of sensiti...

Security update for the Linux Kernel (Live Patch 62 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122234 fixes several issues. The following security issues were fixed: CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing bsc1233708...

Security update for the Linux Kernel (Live Patch 55 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059198 fixes one issue. The following security issue was fixed: CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream bsc1238730. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods...

RHEL 8 : kernel (RHSA-2025:9497)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9497 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tipc: fix use-after-free Read ...

RHEL 9 : kernel (RHSA-2025:9491)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9491 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ndisc: use RCU protection in...

RHEL 10 : rhc (RHSA-2025:9514)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9514 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

Google Chrome Security Update (stable-channel-update-for-desktop_24-2025-06) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

RHEL 9 : kernel (RHSA-2025:9494)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9494 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: tipc: fix use-after-free Read ...

Session Fixation

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Session Fixation via the sesskey parameter. An attacker can gain unauthorized access to another user's session by obtaining and reusing the sesskey within the OAuth2 login flow, resulting in the...

Updated udisks2 & libblockdev packages fix security vulnerabilities

A Local Privilege Escalation LPE vulnerability was found in libblockdev. Generally, the "allowactive" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allowactive" user on a syst...