Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.8.1. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU...

GStreamer 安全漏洞

GStreamer is a GStreamer open source set of frameworks for processing streaming media. A security vulnerability exists in GStreamer that stems from parsing H266 sei messages without properly validating the length of user-supplied data, which could lead to remote code execution...

ALSA-2025:10353 Moderate: socat security update

The socat utility establishes bi-directional byte streams and transfers data between them. The utility can establish streams between a large set of channels, such as files, pipes, devices, and sockets. Security Fixes: socat: arbitrary file overwrite via predictable /tmp directory CVE-2024-54661 F...

Fixed in Apache Tomcat 10.1.43

Low: DoS due to overflow in file upload limit CVE-2025-52520 For some unlikely configurations of multipart upload, an Integer Overflow vulnerability could lead to a DoS via bypassing of size limits. This was fixed with commit fc42bbcc. This issue was reported to the Tomcat security team on 7 June...

Fixed in Apache Tomcat 11.0.9

Low: DoS due to overflow in file upload limit CVE-2025-52520 For some unlikely configurations of multipart upload, an Integer Overflow vulnerability could lead to a DoS via bypassing of size limits. This was fixed with commit a51e4bed. This issue was reported to the Tomcat security team on 7 June...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.8.1. Vulnerability Details CVEID:CVE-2024-47535 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An...

CVE-2015-20112

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

CVE-2015-20112

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step via the RLPx process. An attacker can potentially access confidential information by exploiting the use of two CTR streams that share the same key, IV, and nonce, which may allow decryption of network traffic...

PT-2025-27383 · Rlpx · Rlpx

Name of the Vulnerable Software and Affected Versions: RLPx version 5 Description: The issue concerns RLPx 5, which has two CTR streams based on the same key, IV, and nonce. This design flaw can facilitate decryption on a private network. Recommendations: For RLPx version 5, consider reconfigurin...

Ethereum RLPx 安全漏洞

Ethereum RLPx is a TCP-based transport protocol from Ethereum used for communication between Ethernet nodes. A security vulnerability exists in Ethereum RLPx that stems from two CTR streams based on the same key, IV, and random number, potentially facilitating decryption on a private network...

CVE-2015-20112

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

CVE-2015-20112

CVE-2015-20112 concerns Ethereum’s RLPx 5 transport. The vulnerability arises because two CTR streams run from the same key, IV, and nonce, which could allow an adversary to decrypt traffic on a private network. Affected component: RLPx 5. Underlying issue: re-use of CTR parameters across streams...

CVE-2015-20112: Missing Cryptographic Step

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network...

Private Continual Counting of Unbounded Streams

We study the problem of differentially private continual counting in the unbounded setting where the input size $n$ is not known in advance. Current state-of-the-art algorithms based on optimal instantiations of the matrix mechanism cannot be directly applied here because their privacy guarantees...

OESA-2025-1656 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

DEBIAN-CVE-2022-50049

In the Linux kernel, the following vulnerability has been resolved: ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcmaddpaths, it doesn't check whether the picked BE actually supports for the given stream direction. Due to that, when an asymmetric ...

Security Bulletin: IBM Event Streams is vulnerable to Server Side Request Forgery (SSRF) due to the axios component (CVE-2025-27152).

Summary IBM Event Streams is vulnerable to Server Side Request Forgery SSRF due to the axios component. In event streams, axios is used to make HTTP requests to the Event Streams REST Admin API, such as creating or listing Kafka topics. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axio...

MAL-2025-4824 Malicious code in electron-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91208cc2a76d45e148c93d7469a0c3f62f107923f3f3829a15facb4fb20d0d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in electron-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91208cc2a76d45e148c93d7469a0c3f62f107923f3f3829a15facb4fb20d0d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...