Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.0 security and extras update

Red Hat OpenShift Container Platform release 4.19.0 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

CVE-2025-6199

A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the...

CGA-MJG9-H2JR-FQRQ

Bulletin has no description...

gimp:2.8 security update

gimp 2:2.8.22-26.2 - fix CVE-2025-5473 RHEL-95696 2:2.8.22-26.1 - fix CVE-2025-48797 RHEL-93503 - fix CVE-2025-48798 RHEL-93506 pygobject2 2.28.7-5 - bump spec to fix NVR pygtk2 2.24.0-25 - Fix shebang mangling for prefix=app 1907579 - disable numpy for flatpak 1907579 python2-pycairo 1.16.3-7 -...

Security Updates for Microsoft Word Products (June 2025)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-32717, CVE-2025-47168,...

Slackware Linux 15.0 / current xorg-server Multiple Vulnerabilities (SSA:2025-168-01)

The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.17 / 21.1.4 / 24.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-168-01 advisory. New xorg-server packages are available for Slackware 15.0 and -current to fix security...

Alibaba Cloud Linux 3 : 0088: perl-FCGI:0.78 (ALINUX3-SA-2025:0088)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0088 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-40907: FCGI versions 0.44 through 0.82, fo...

PT-2025-25722 · Unknown · Ebook Store

Name of the Vulnerable Software and Affected Versions: Ebook Store versions n/a through 5.8008 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

container-tools:ol8 security update

aardvark-dns buildah 2:1.33.12-2 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 https://github.com/containers/buildah/commit/cf49e7c - fixes 'CVE-2025-22871 container-tools:rhel8/buildah: Request smuggling due to acceptance of invalid chunked data in...

Security Updates for Microsoft Office Products (June 2025)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-47164, CVE-2025-47167,...

GHSA-RVPW-P7VW-WJ3M OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

protobuf-python has a potential Denial of Service issue

Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. Reporter: Alexis Challande, Trail of Bits...

SUSE-SU-2025:01967-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-52927: netfilter: allow exp not to be removed in nfctfindexpectation bsc1239644. - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative...

SUSE-SU-2025:01965-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching bsc1242006. - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: can: bcm: added locking for bcmop runtime updates. The CAN broadcast manager CAN BCM can send a sequence of CAN frames via hrtimer. The content and length of the sequence can be changed during runtime, after which the ‘currframe’...

A week in security (June 9 – June 15)

Last week on Malwarebytes Labs: Been scammed online? Here’s what to do How and where to report an online scam Google bug allowed phone number of almost any user to be discovered 44% of people encounter a mobile scam every single day, Malwarebytes finds GirlsDoPorn owner faces life in jail after...

TencentOS Server 3: edk2 (TSSA-2023:0279)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0279 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2025-25554 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2 fix pack 8 through fix pack 20 Liferay Portal versions 7.3 GA through update 35 Liferay Portal versions 7.4.0 through 7.4.3.97 Liferay DXP versions 7.4 GA through update 92 Liferay DXP versions 2023.Q3.1 through...