13871 matches found
[SECURITY] [DLA 4057-1] openssh security update
Debian LTS Advisory DLA-4057-1 [email protected] https://www.debian.org/lts/security/ Colin Watson February 18, 2025 https://wiki.debian.org/LTS Package : openssh Version : 1:8.4p1-5+deb11u4 CVE ID : CVE-2025-26465 The Qualys Threat Research Unit TRU discovered that the OpenSSH client i...
CVE-2025-1390 pam_cap: Fix potential configuration parsing error
The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to...
openSUSE Security Advisory (SUSE-SU-2025:0406-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2025-11023
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.13.0-09623-g6c216bc522fd Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the migrate device finalize function, where a folio to be freed is not added to the LRU,...
CVE-2025-25195
Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...
Oracle Linux 9 : libxml2 (ELSA-2025-1350)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1350 advisory. 2.9.13-6.1 - Fix CVE-2022-49043 RHEL-76298 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...
Fedora: Security Advisory (FEDORA-2025-33e7714792)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
container-tools:rhel8 security update
An update is available for module.toolbox, cockpit-podman, containers-common, module.criu, module.conmon, module.aardvark-dns, module.containers-common, module.python-podman, oci-seccomp-bpf-hook, module.fuse-overlayfs, module.oci-seccomp-bpf-hook, module.udica, module.crun, container-selinux,...
Updated ark packages fix security vulnerability
A security issue exists in Ark where a maliciously crafted archive containing file paths beginning with "/" allows files to be extracted to locations outside the intended directory...
CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()
The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...
CVE-2025-24904 libsignal-service-rs doesn't sanity check plaintext envelopes are not sanity-checked
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and m...
CVE-2025-21700
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo...
CVE-2025-21700 net: sched: Disallow replacing of child qdisc from one parent to another
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo...
Security update for SUSE Manager Client Tools
This update fixes the following issues: salt: Revert setting SELinux context for minion service bsc1233667 Removed System V init support Fix the condition of alternatives for Tumbleweed and Leap 16 Build all python bindings for all flavors Make minion reconnecting on changing master IP bsc1228182...
PT-2025-23013
Name of the Vulnerable Software and Affected Versions NVIDIA CUDA Toolkit affected versions not specified Description The issue is related to a failure to check the length of a buffer in the cuobjdump binary, which could allow a user to cause the tool to crash or execute arbitrary code by passing...
PT-2025-6523 · WordPress · Chalet-Montagne.Com Tools
Name of the Vulnerable Software and Affected Versions: Chalet-Montagne.com Tools WordPress plugin versions 2.7.8 and earlier Description: The issue arises from the plugin not sanitizing and escaping a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting...
Moderate: nodejs:18 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: undici: Undici Uses Insufficiently Random Values CVE-2025-22150 nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap CVE-2025-23085 For mor...
CVE-2025-1146
CrowdStrike uses industry-standard TLS transport layer security to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where o...
CVE-2025-21697 drm/v3d: Ensure job pointer is set to NULL after job completion
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Ensure job pointer is set to NULL after job completion After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when unloading the driver, as it appears the...