CVE-2025-52994

The CVE-2025-52994 entry describes an OS Command Injection in phpThumb prior to version 1.7.24, caused by gif_outputAsJpeg in phpthumb.gif.php when given a crafted parameter. Affected versions include 1.7.23 and earlier; the issue is fixed in 1.7.23-202506081709, with advisories indicating upgrad...

SUSE CVE-2025-38279

In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue 1 where the following warning appears in kernel dmesg: 60.643604 verifier backtracking bug 60.643635 WARNING: CPU: 10 PID: 2315...

CVE-2025-53542 Kubernetes Headlamp Allows Arbitrary Command Injection in macOS Process headlamp@codeSign

Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of the Kubernetes Headlamp project. This issue arises due to the improper use of Node.js's execSync function with unsanitized input derived...

CVE-2025-27613

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled...

CVE-2025-46835

Git GUI is vulnerable to arbitrary file creation/overwrites when a user clones an untrusted repository and is tricked into editing a file under a maliciously named directory; this can affect files the user can write. The issue is fixed in Git GUI versions 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2...

CVE-2025-46835 Git GUI can create and overwrite files for which the user has write permission

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permissio...

CVE-2025-46835 Git GUI can create and overwrite files for which the user has write permission

Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permissio...

CVE-2025-37800 affecting package kernel for versions less than 6.6.92.2-1

CVE-2025-37800 affecting package kernel for versions less than 6.6.92.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-37836 affecting package kernel for versions less than 6.6.92.2-1

CVE-2025-37836 affecting package kernel for versions less than 6.6.92.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-46334 Git GUI malicious command injection on Windows

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

CVE-2025-27613

Gitk (the Tcl/Tk based Git history browser) is affected by CVE-2025-27613. When a user clones an untrusted repository and runs gitk without extra arguments, files that the user can write to may be created and truncated. The vulnerability is triggered by the per-file encoding option in Gitk’s Pref...

SUSE-SU-2025:02277-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2025-4945: Add value checks for date/time parsing bsc1243314...

CVE-2025-38347

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 0 "echo 0...

CVE-2025-38339

In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf: fix JIT code size calculation of bpf trampoline archbpftrampolinesize provides JIT size of the BPF trampoline before the buffer for JIT'ing it is allocated. The total number of instructions emitted for BPF trampoline...

UBUNTU-CVE-2025-38342

In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in softwarenodegetreferenceargs softwarenodegetreferenceargs wants to get @index-th element, so the property value requires at least 'index + 1 sizeofref' bytes but that can not be guaranteed by...

AZL-64961 CVE-2025-38305 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp-nvclocks check logic in ptpvclockinuse There is no disagreement that we should check both ptp-isvirtualclock and ptp-nvclocks to check if the ptp virtual clock is in use. However, when we acquire ptp-nvclocksmux t...

CVE-2025-38347 f2fs: fix to do sanity check on ino and xnid

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 0 "echo 0...

CVE-2025-38346

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd66f067 PUD 1bd671067 PMD 101808067 PTE...

CVE-2025-38343 wifi: mt76: mt7996: drop fragments with multicast or broadcast RA

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: drop fragments with multicast or broadcast RA IEEE 802.11 fragmentation can only be applied to unicast frames. Therefore, drop fragments with multicast or broadcast RA. This patch addresses vulnerabilities suc...

CVE-2025-38342 software node: Correct a OOB check in software_node_get_reference_args()

In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in softwarenodegetreferenceargs softwarenodegetreferenceargs wants to get @index-th element, so the property value requires at least 'index + 1 sizeofref' bytes but that can not be guaranteed by...