UBUNTU-CVE-2025-21959

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize struct nfconncounttuple in inserttree Since commit b36e4523d4d5 "netfilter: nfconncount: fix garbage collection confirm race", cpu and jiffies32 were introduced to the struct...

CVE-2025-21971 net_sched: Prevent creation of classes with TC_H_ROOT

In the Linux kernel, the following vulnerability has been resolved: netsched: Prevent creation of classes with TCHROOT The function qdisctreereducebacklog uses TCHROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created wi...

CVE-2025-21971 net_sched: Prevent creation of classes with TC_H_ROOT

In the Linux kernel, the following vulnerability has been resolved: netsched: Prevent creation of classes with TCHROOT The function qdisctreereducebacklog uses TCHROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created wi...

CVE-2025-21971

Summary (CVE-2025-21971): In the Linux kernel, an issue in net_sched can cause incorrect parent backlog statistics when a Qdisc class is created with classid TC_H_ROOT (0xFFFFFFFF). The traversal in qdisc_tree_reduce_backlog() terminates at TC_H_ROOT instead of the actual root, which can lead to ...

The vulnerability of the btrfs_ref_tree_mod() function in the fs/btrfs/ref-verify.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrfsreftreemod function in the fs/btrfs/ref-verify.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

[SECURITY] Fedora 41 Update: augeas-1.14.2-0.4.20250324git4dffa3d.fc41

A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...

Malicious code in dir-tree-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e24acc439ef66f72887d3c3ea802bef5645428d0247a824fe61d4454840fdfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2754 Malicious code in dir-tree-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e24acc439ef66f72887d3c3ea802bef5645428d0247a824fe61d4454840fdfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 42 Update: augeas-1.14.2-0.4.20250324git4dffa3d.fc42

A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...

USN-7383-2 linux-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Ublk userspace block driver; -...

The vulnerability of the btrfs component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the btrfs component of the Linux operating system’s kernel is related to the use of an uninitialized resource in the functions replayonename and checkiteminlog in fs/btrfs/tree-log.c. Exploiting this vulnerability could allow a attacker to cause a service failure...

WordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by timomangcut in WordPress Plugin Navigation Tree Elementor versions = 1.0.1...

MAL-2025-2604 Malicious code in tree-sitter-erlang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 712279ef7d69026b60fa7e5d9007249ac05502576b2a1164da1dbafca2be44f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tree-sitter-erlang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 712279ef7d69026b60fa7e5d9007249ac05502576b2a1164da1dbafca2be44f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

H2O 资源管理错误漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A resource management error vulnerability exists in H2O version 3.46.0.1, which stems from the runtool command exposing classes in the water.tools package via the ast parser, which could lead to a deni...

Memory Exhaustion in Expr Parser with Unrestricted Input

Impact If the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent extremely large expression c...

CVE-2025-29786

A flaw was found in Expr. This vulnerability allows excessive memory usage and potential out-of-memory OOM crashes via unbounded input strings, where a malicious or inadvertent large expression can cause the parser to construct an extremely large Abstract Syntax Tree AST, consuming excessive...

DEBIAN-CVE-2025-29786

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parseExpression function in parser.go, due to the unrestricted size of input strings, which can cause the generation of large Abstract Syntax Trees ASTs. An attacker can crash...

CVE-2025-29786

CVE-2025-29786 concerns the Expr expression parser (Go). Prior to 1.17.0, unbounded input can cause the parser to build an excessively large AST, leading to high memory usage or an OOM crash. The issue is mitigated by a patch in 1.17.0 that enforces node budget and memory limits during parsing. R...