CLSA-2025-1745956171 freetype: Fix of CVE-2025-27363

CVE-2025-27363: fix out of bounds write in font subglyph structures parsing...

CLSA-2025-1745945560 harfbuzz: Fix of CVE-2023-25193

CVE-2023-25193: fix On^2 growth triggered by consecutive marks during mark attachment...

CVE-2025-4089

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

Security update for expat

This update for expat fixes the following issues: Version update to 2.7.1: Bug fixes: Restore event pointer behavior from Expat 2.6.4 that the fix to CVE-2024-8176 changed in 2.7.0; affected API functions are: XMLGetCurrentByteCount XMLGetCurrentByteIndex XMLGetCurrentColumnNumber...

CVE-2025-24270

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may be able to leak sensitive user information...

CVE-2025-30445

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-5154)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability found in the cri-o component which could allow an attacker to send a specially crafted URL request containing "dot dot" sequences /../ to read and write arbitrary files on the system. Vulnerability Details CVEID:...

CVE-2025-31197

A security vulnerability in Apple iOS and iPadOS (prior to versions 18.4) is caused by insufficient checks , which can lead to an unexpected application termination . This issue can be triggered by an attacker on the local network . The vulnerability has been addressed with improved checks in the...

CVE-2025-24206

An authentication issue in Apple's AirPlay service allows an attacker on the local network to bypass authentication policy . The vulnerability is caused by a deficiency in the authentication mechanism and was addressed through improved state management . Affected products include iOS , iPadOS , m...

CVE-2025-24251

A security vulnerability exists in multiple Apple products, including macOS , iOS , iPadOS , tvOS , watchOS , and visionOS , stemming from insufficient checks . An attacker on the local network may exploit this issue to cause an unexpected app termination . The vulnerability has been addressed in...

CVE-2025-24251

The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An attacker on the local network may cause an unexpected app termination...

CVE-2025-30445

A type confusion vulnerability exists in Apple's AirPlay protocol, which can be exploited by an attacker on the local network to cause an unexpected app termination . This flaw was part of the AirBorne research and has been addressed with improved checks. The issue affects multiple operating syst...

CVE-2025-30445

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination...

CVE-2025-30445

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4. An attacker on the local network may cause an unexpected app termination...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-070)

The version of kernel installed on the remote host is prior to 5.15.180-122.191. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-070 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-throttle: Set BIOTHROTTLED when...

GHSA-WMJQ-JRM2-9WFR NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake “Driver”. When using the Easy Logging feature on Linux and macOS the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to...

Moderate: Red Hat Security Advisory: glibc security update

An update for glibc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

PT-2025-19692 · Crates.Io · Mp3-Metadata

The get id3 methods used by mp3 metadata::read from slice does not perform adequate bounds checking when recreating the tag due to the use of desynchronization. Fixed in Fix index error, released as part of 0.4.0...

RHEL 9 : mod_auth_openidc (RHSA-2025:4225)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:4225 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

PT-2025-18016

Name of the Vulnerable Software and Affected Versions Apereo CAS version 5.2.6 Description A vulnerability was found in Apereo CAS, affecting the function ResponseEntity of the file ManageRegisteredServicesMultiActionController.java. The manipulation of the argument Query leads to inefficient...