JLSEC-2025-307 A null pointer dereference issue was found in Libtiff's `tif_dir.c` file

A null pointer dereference issue was found in Libtiff's tifdir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial o...

JLSEC-2025-299 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in `tools/tiffcrop.c:3516`, allowing attackers...

LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127...

JLSEC-2025-323 A flaw has been found in LibTIFF 4.7.0

A flaw has been found in LibTIFF 4.7.0. This affects the function TIFFmallocExt/TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is...

JLSEC-2025-262 Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a...

Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045...

JLSEC-2025-258 A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's...

A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

JLSEC-2025-277 libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read...

libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop...

JLSEC-2025-319 A vulnerability was found in LibTIFF up to 4.7.0

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2preadtiffinit of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally...

JLSEC-2025-275 A stack overflow was discovered in the `_TIFFVGetField` function of Tiffsplit v4.4.0

A stack overflow was discovered in the TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Beyond JSON: Converting Spring AI Tool Response Formats to TOON, XML, CSV, YAML, ...

JSON is the go-to format for LLM tool responses, but recent discussions around alternative formats like TOON Token-Oriented Object Notation claim potential benefits in token efficiency and performance. While the debate continues—with critical analyses pointing to context-dependent results—the...

RHEL 9 : buildah (RHSA-2025:22011)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22011 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

EUVD-2025-199173

Malicious code in csv-tool-cli npm...

Malicious code in csv-tool-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4710ebc34f0c5b28d34c41d165d2fff2c6ea04e90038226c7b328283319dd2a4 The package csv-tool-cli was found to contain malicious code. Source: ghsa-malware 7a82657ae868943eebe70053efe5b50087b24ce2a81a2c5eccca35dcb483a1f2 A...

MAL-2025-191084 Malicious code in csv-tool-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4710ebc34f0c5b28d34c41d165d2fff2c6ea04e90038226c7b328283319dd2a4 The package csv-tool-cli was found to contain malicious code. Source: ghsa-malware 7a82657ae868943eebe70053efe5b50087b24ce2a81a2c5eccca35dcb483a1f2 A...

EUVD-2025-198997

Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service...

The Future of Cloud Security: A New Act for Cyber Risk Operations

Qualys, the leader in Cyber Risk Operations, is proud to be recognized in Latio Tech’s 2025 Cloud Security Market Report as a leader in both CTEM and the Cloud Security Ecosystem. This acknowledgement by Latio Tech reinforces the strength of our strategy—anchored by the industry’s first Risk...

CVE-2025-48510

CVE-2025-48510 concerns AMD uProf, where an improper return value mishandling in a component of the AMD μProf tool can allow a local attacker to bypass KSLR, potentially compromising confidentiality or availability. The publicly cited sources describe a local-access vulnerability affecting uProf;...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

PT-2025-47967

Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service...

IBM Concert 加密问题漏洞

IBM Concert is a generative artificial intelligence-driven automated application management and monitoring tool based on the watsonx platform released in May 2024 by IBM. IBM Concert suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which can ...