CVE-2025-38145

CVE-2025-38145 affects the Linux kernel in the ASPEED SoC driver (aspeed_lpc_enable_snoop). The vulnerability is due to not checking the return value of devm_kasprintf(), which can return NULL on memory allocation failure, leading to a NULL pointer dereference. The connected documentation confirm...

CVE-2025-38135 serial: Fix potential null-ptr-deref in mlb_usio_probe()

In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlbusioprobe devmioremap can return NULL on error. Currently, mlbusioprobe does not check for this case, which could result in a NULL pointer dereference. Add NULL check after devmioremap t...

CVE-2025-38129 page_pool: Fix use-after-free in page_pool_recycle_in_ring

In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix use-after-free in pagepoolrecycleinring syzbot reported a uaf in pagepoolrecycleinring: BUG: KASAN: slab-use-after-free in lockrelease+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a...

CVE-2025-38111

The CVE-2025-38111 entry concerns the Linux kernel, specifically the MDIO bus driver (net/mdiobus). The issue arises from ioctl parameter handling that could accept MDIO addresses beyond PHY_MAX_ADDR (32), potentially enabling out-of-bounds reads/writes via mdiobus operations. The fix adds addres...

CVE-2025-38111

In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed ...

CVE-2025-38111 net/mdiobus: Fix potential out-of-bounds read/write access

In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed ...

CVE-2025-38108

CVE-2025-38108 affects the Linux kernel’s network scheduler, specifically the RED qdisc. The issue is a race in __red_change() where the SFQ perturb timer can fire at an inopportune time, allowing an underflow of a parent qlen during a concurrent qdisc_tree_flush/backlog sequence. The race scenar...

CVE-2025-38106

Mode C: Concrete details found. The CVE-2025-38106 issue is in the Linux kernel io_uring/sqpoll path, where a use-after-free of sq->thread could occur when __io_uring_show_fdinfo() uses a freed task_struct. The SUSE/OpenSUSE advisory notes the fix: assign and look up sq->thread under RCU wi...

PT-2025-27805 · WordPress · Wpvivid Backup/Migration

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress versions up to, and including, 0.9.116 Description: The issue is related to arbitrary file uploads due to missing file type validation in the wpvivid upload import...

OPENSUSE-SU-2025:15282-1 python311-rfc3161-client-1.0.3-1.1 on GA media

These are all security issues fixed in the python311-rfc3161-client-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15297-1 libspdlog1_15-1.15.3-2.1 on GA media

These are all security issues fixed in the libspdlog115-1.15.3-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-27736 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the af packet module, where calling PACKET ADD MEMBERSHIP on an ops-locked device can trigger the NETDEV...

OPENSUSE-SU-2025:15235-1 kubernetes1.31-apiserver-1.31.10-1.1 on GA media

These are all security issues fixed in the kubernetes1.31-apiserver-1.31.10-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15210-1 chromedriver-138.0.7204.96-1.1 on GA media

These are all security issues fixed in the chromedriver-138.0.7204.96-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15308-1 libwireshark18-4.4.7-1.1 on GA media

These are all security issues fixed in the libwireshark18-4.4.7-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15241-1 libsoup-3_0-0-3.6.5-6.1 on GA media

These are all security issues fixed in the libsoup-30-0-3.6.5-6.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15281-1 python311-requests-2.32.4-1.1 on GA media

These are all security issues fixed in the python311-requests-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed...

Updated rootcerts, nss & firefox packages fix security vulnerabilities

CVE-2025-6424: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. CVE-2025-6425: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private...

CVE-2025-52559 Zulip XSS in digest preview URL

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting XSS vulnerability in both topi...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via std::atomicint in reference counting process. An attacker can execute arbitrary code or cause a denial of service by overflowing the reference count and triggering access to memory after it has been freed. Remediation...