aws-efs-utils-2.2.1-1.1 on GA media (moderate)

aws-efs-utils-2.2.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14951-1 Rating: moderate Cross-References: CVE-2020-35881 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

Ubuntu 24.04 LTS / 24.10 : XZ Utils vulnerability (USN-7414-1)

The remote Ubuntu 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7414-1 advisory. Harri K. Koskinen discovered that XZ Utils incorrectly handled the threaded xz decoder. If a user or automated system were tricked into processing an xz...

Malicious code in niji-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b0f37153a7862a4b1e5abd871385e93b6535a8bb834f03fc9bb83b9e7be6640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3082 Malicious code in niji-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b0f37153a7862a4b1e5abd871385e93b6535a8bb834f03fc9bb83b9e7be6640 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 568ba985579400ab47e546c13e36f6e7d3ff6e81d4411918b10eee2f384b349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3027 Malicious code in keypair-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 568ba985579400ab47e546c13e36f6e7d3ff6e81d4411918b10eee2f384b349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-14778

Name of the Vulnerable Software and Affected Versions XZ Utils versions 5.3.3alpha through 5.8.0 Description The multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null...

MAL-2025-2758 Malicious code in events-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b57ab91cc267a455c80351de64025885c4a43811e4cb5bf953e36da0ef3057b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in events-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b57ab91cc267a455c80351de64025885c4a43811e4cb5bf953e36da0ef3057b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @takamol/qiwa-env-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b86c910b37e0839cc34589794e9d597808f078c030da985d763aa3220ebd827 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-191706 Malicious code in conn-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086 Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets...

Malicious code in conn-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086 Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets...

@capriza/far (>=0.1.2 <=2.4.2), @cobalt-engine/cobower (=2.0.0) +388 more potentially affected by CVE-2024-12905 via tar-fs (>=0.1.8 <=1.16.3)

tar-fs NPM version =0.1.8, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.0.5, =1.1.2 - @elm-node/npm-scripts =1.0.0 - @hlsrules-test/fc-libreoffice =1.0.0 and more Source cves: CVE-2024-12905 Source advisory: OSV:GHSA-PQ67-2WWV-3X...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

DEBIAN-CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

AZL-59273 CVE-2025-2312 affecting package cifs-utils for versions less than 6.14-3

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

AZL-59284 CVE-2025-2312 affecting package cifs-utils for versions less than 7.3-1

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

CVE-2025-2312 affects cifs-utils (cifs.upcall) where, in containerized environments, an upcall is made to the wrong namespace, risking disclosure of the host Kerberos credentials cache. Public advisories across multiple distributions (Debian, Mageia, Alpine Linux, CBL-Mariner) confirm the flaw an...