PT-2025-33478 · Fedora · Shim

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired, potentially allowing the loading of old or invalid signed boot components...

kernel security update

5.14.0-570.33.2.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

kernel security update

4.18.0-553.69.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

NewStart CGSL MAIN 7.02 : shim Multiple Vulnerabilities (NS-SA-2025-0179)

The remote NewStart CGSL host, running version MAIN 7.02, has shim packages installed that are affected by multiple vulnerabilities: - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's...

Oracle Linux 10 : kernel (ELSA-2025-8137)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-8137 advisory. 6.12.0-55.19.1.0.10.OL10 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Add new Oracle Linux Driver Signing key 1 certificate...

CLSA-2025-1751552694 Update of shim

Use both AlmaLinux and CloudLinux certs for checking images - Debrand to TuxCare - No SB support for aarch64 on TuxCare yet...

Malicious code in deere-ui-commonjs-shim (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a67ec4bddb1b8af04cfc08903b303377f2c20937c3b6f13287bcb450d2189a53 Any computer that has this package installed or running should be considered...

TencentOS Server 2: shim (TSSA-2024:0150)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0150 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 3: shim (TSSA-2024:0131)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0131 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 4: shim (TSSA-2024:0566)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0566 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

NewStart CGSL MAIN 7.02 : shim Multiple Vulnerabilities (NS-SA-2025-0086)

The remote NewStart CGSL host, running version MAIN 7.02, has shim packages installed that are affected by multiple vulnerabilities: - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's...

CVE-2021-23840 affecting package shim-unsigned-x64 for versions less than 1.1.1-1

CVE-2021-23840 affecting package shim-unsigned-x64 for versions less than 1.1.1-1. A patched version of the package is available...

Alibaba Cloud Linux 3 : 0164: grub2, mokutil, shim, and shim-unsigned-x64 (ALINUX3-SA-2022:0164)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0164 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-3695: A crafted 16-bit grayscale...

Alibaba Cloud Linux 3 : 0114: shim (ALINUX3-SA-2024:0114)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0114 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-40546: A flaw was found in Shim...

Malicious code in my-rei-browser-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c686104ae598e6be85ee3b485920aef58f29d1ece0db3383bbca1afa64b8f405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3407 Malicious code in my-rei-browser-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c686104ae598e6be85ee3b485920aef58f29d1ece0db3383bbca1afa64b8f405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-23841 affecting package shim-unsigned-aarch64 for versions less than 15.8-5

CVE-2021-23841 affecting package shim-unsigned-aarch64 for versions less than 15.8-5. A patched version of the package is available...

CVE-2021-23841 affecting package shim-unsigned-x64 for versions less than 15.8-5

CVE-2021-23841 affecting package shim-unsigned-x64 for versions less than 15.8-5. A patched version of the package is available...

kernel security update

5.14.0-503.35.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

org.apache.kylin:kylin-engine-build-sdk (>=5.0.0 <=5.0.0-beta), org.apache.ranger:ranger-kylin-plugin (>=2.5.0 <=2.8.0) +1 more potentially affected by CVE-2025-30067 via org.apache.kylin:kylin-core-common (>=4.0.4 <=5.0.0)

org.apache.kylin:kylin-core-common MAVEN version =4.0.4, =5.0.0, =2.5.0, =2.5.0, =2.8.0 Source cves: CVE-2025-30067 Source advisory: SNYK:JAVA-ORGAPACHEKYLIN-9538803...