kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ipvsprotocolinit Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as the terminator instruction for...

CVE-2025-64181: Use of Uninitialized Variable

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on...

PT-2025-49382

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the sctp transport update rto function that may lead to a shift-out-of-bounds condition. This issue was identified by syzbot, which reported a potenti...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990374 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kvdpm.c Adds bounds check for sumovidmappingentry. Tenable has...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989904)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989904 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kvdpm.c Adds bounds check for sumovidmappingentry. Tenable has...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988914)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988914 advisory. In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg-alloctype As Wenqing Liu reported in bugzilla:...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989631)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989631 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga For pptable structs that use...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989086 advisory. In the Linux kernel, the following vulnerability has been resolved: gpio: wcd934x: Fix shift-out-of-bounds error bit-mask for pins 0 to 4 is BIT0 to BIT4 however we...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988664)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988664 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 For pptable structs that use flexible array...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990081 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ipvsprotocolinit Under certain kernel...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989007)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989007 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Add check for negative dbl2nbperpage l2nbperpage is log2number of blks per page, and the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990325 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-iocost: avoid out of bounds shift UBSAN catches undefined behavior in blk-iocost, where...

SUSE: Security Advisory (SUSE-SU-2025:1771-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : Firefox -- Sandbox escape due to undefined behavior (8b5f4eb3-b808-11f0-8016-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8b5f4eb3-b808-11f0-8016-b42e991fc52e advisory. https://bugzilla.mozilla.org/showbug.cgi?id=1986185 reports: Sandbox escape due to undefined behavior,...

opensc:fuzz_pkcs15_encode: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/OpenSC/OpenSC.git Detailed Report: https://oss-fuzz.com/testcase?key=5970178929393664 Project: opensc Fuzzing Engine: libFuzzer Fuzz Target: fuzzpkcs15encode Job Type: libfuzzerubsanopensc Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x0000000000...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: gfs2: Validating idepth for exhash directories A fuzzer test introduced corruption where the depth of the directory reached 0 in direread. This caused an undefined shift of 32 bits at the line: index = hash 32 - dip-idepth; As...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a proclayoutcommit with an undefined FlexFiles layout type, which could lead to a crash...

CVE-2025-58189: Undefined Security Weakness

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...

CVE-2025-40080: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 "nbd: verify socket is supported during setup" made sure the socket supported a shutdown method. Explicitel...

curl: CURLX_SET_BINMODE(NULL) can call fileno(NULL) and cause undefined behavior / crash

Summary ------- Calling the CURLXSETBINMODEstream macro with stream == NULL leads to an unguarded call to filenoNULL in toolbinmode.h, which is undefined behavior and may crash the process. This is a robustness/UB issue and should be corrected by guarding against NULL streams before calling filen...