This Week in Spring - May 13th, 2025

Hi, Spring fans! As I write this, I'm at the amazing Code Remix event in Miami well, technically Tampa, Florida. I'll also be speaking at the Tampa JUG while I'm there, so look out! After that, I'll be headed back to Europe—a wee bit further north this time—to Stockholm for the amazing JForum...

ALSA-2025:7076 Moderate: gnutls security update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS CVE-2024-12243 For more details...

ROS-2-474

2.474 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to an...

PT-2025-20903

Name of the Vulnerable Software and Affected Versions Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, 6.4.0 through 6.4.10 Fortinet FortiRecorder versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.5, 6.4.0 through 6.4.5 Fortinet FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4,...

Siemens User Management Component (UMC)

SUMMARY Siemens User Management Component UMC is affected by three vulnerabilities which could allow an unauthenticated remote attacker to cause a denial of service condition. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens...

2025.2 IPU, Intel® Processor Advisory

Summary: Potential security vulnerabilities in some Intel® Processors may allow denial of service. Intel is releasing microcode updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-20103 Description: Insufficient resource pool in the core management mechanis...

Intel® Arc™ GPU Advisory

Summary: A potential security vulnerability in some Intel® Arc™ GPU may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-28036 Description: Improper conditions check for some Intel® Arc™ GPU may allow an...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2025-3844)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3844 advisory. 1:1.8.0.442.b06-1.0.3 - Fixed CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698 Orabug: 37840723 Tenable has extracted the preceding description block...

Intel® Ethernet Network Adapter Software  Advisory

Summary: Potential security vulnerabilities in some Intel® Ethernet Network Adapter software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-20104 Description: Race condition in some...

Intel® Server Board D50DNP and M50FCP Firmware Advisory

Summary: Potential security vulnerabilities in the Intel Server Board D50DNP and M50FCP may allow escalation of privileges or information disclosure. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-20082 Description:...

OpenVINO™ Model Server Software Advisory

Summary: A potential security vulnerability in the OpenVINO™ model server software maintained by Intel® may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-22892 Description: Uncontrolled resource...

Slackware Linux 15.0 / current screen Multiple Vulnerabilities (SSA:2025-133-01)

The version of screen installed on the remote host is prior to 4.9.1 / 5.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-133-01 advisory. New screen packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

Security Updates for Microsoft SharePoint Server Subscription Edition (May 2025)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Elevation of Privilege Vulnerability CVE-2025-29976 - Remote Code Execution Vulnerabilites. CVE-2025-30378, CVE-2025-30382,...

APSB25-52 : Security update available for Adobe ColdFusion

Adobe has released security updates for ColdFusion versions 2025, 2023 and 2021. These updates resolve critical, important and moderate vulnerabilities that could lead to arbitrary file system read, arbitrary code execution and privilege escalation...

ROS-2-514

2.514 Memory Leak in GNU Tar CVE-2021-20193 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a DoS attack on a target system. The vulnerability exists due to a memory leak in the readheader function in list.c. A remote attacker could pass a specially crafted...

PT-2025-20862 · Siemens · Ruggedcom Rox Mx5000 +8

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM ROX MX5000 versions prior to V2.16.5 RUGGEDCOM ROX MX5000RE versions prior to V2.16.5 RUGGEDCOM ROX RX1400 versions prior to V2.16.5 RUGGEDCOM ROX RX1500 versions prior to V2.16.5 RUGGEDCOM ROX RX1501 versions prior to V2.16.5...

ROS-2-338

2.338 Notification on update of the Red OS OPERATION SYSTEM MIS RU.29926343.02.01-01-24 RED SOFT LLC notifies about the completion of the testing procedure and release of the updated RED OS 7.3 distribution. In order to update your copy of RED OS to the current state, you need to perform a standa...

ROS-2-522

2.522 Multiple vulnerabilities in PostgreSQL CVE-2021-32027, CVE-2021-32028, CVE-2021-32029 1. Vulnerability Description: CVE-2021-32027 The vulnerability allows a remote attacker to execute arbitrary code on the target system. CVE-2021-32028, CVE-2021-32029 Vulnerability allows a remote user to...

ROS-2-652

2.652 OpenVPN Authentication Bypass CVE-2020-15078 1. Vulnerability Description: The vulnerability allows a remote attacker to bypass authentication and access restrictions to leak VPN configuration data. The issue only occurs on servers that are configured to use deferredauth. Under certain...

ROS-2-594

2.594 Vulnerability in Mozilla Thunderbird email client CVE-2021-29970, CVE-2021-30547, CVE-2021-29976, CVE-2021-29969. 1. Vulnerability Description: CVE-2021-29970 Vulnerability in Mozilla Thunderbird email client, related to HTML content processing error. Exploitation of the vulnerability could...