BSA-2017-253

Security Advisory ID : BSA-2017-253 Component : OpenSSH Revision : 2.0: Interim sshdinOpenSSHbefore 6.6 does not properly support wildcards onAcceptEnvlines insshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard...

BSA-2017-211

Security Advisory ID : BSA-2017-211 Component : libidn Revision : 1.0: Interim The idnatoascii4i function in lib/idna.cinlibidnbefore 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via 64 bytes of input. Affected Products Product| Current...

BSA-2017-214

Security Advisory ID : BSA-2017-214 Component : wget Revision : 1.0: Interim Race condition inwget1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open. Affect...

crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algifaead since the source and destination...

gdk-pixbuf Vulnerable to Heap Buffer Overflow via Malicious JPEG Images in 'gdk_pixbuf__jpeg_image_load_increment' Function

gdk-pixbuf is vulnerable to heap buffer overflow due to improper bounds handling in the gdkpixbufjpegimageloadincrement function and gbase64encodestep in glib. This could allow an attacker to trigger a denial-of-service or potentially cause the corruption of memory by processing maliciously craft...

libarchive Vulnerable to Memory Corruption via Integer Overflow in 'archive_read_format_rar_seek_data()' Function

A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enablin...

Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenl...

GnuTLS Vulnerable to Memory Corruption via Double-Free upon Error when Exporting 'otherName' in SAN

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...

Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0 (CVE-2026-0869)

Application User accounts with Brocade ASCG application privileges created by the administrator are not properly being password enforced. Any other user that learns of the assigned user name can access the custom created application manager account and gain access to the Brocade ASCG application...

Path traversal issues in Vims tar.vim and zip.vim plugins

CVE-2025-53905 Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction...

GNU binutils Vulnerable to Memory Corruption via Heap-Based Buffer Overflow in 'elf_swap_shdr()' Function

binutils contains a heap-based buffer overflow vulnerability in its Linker component. A local attacker could exploit this by passing a maliciously crafted payload to a victim, which when executed could result in serious impacts to system confidentiality, integrity and availability...

Libsoup Vulnerable to Integer Overflow via Cookie Expiration Date Handling in Cookie Parsing Logic and Vulnerable to Information Exposure via Out-of-Bounds Read in HTTP Library Component

CVE-2025-4945 A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in...

OpenSSL Stack buffer overflow in CMS AuthEnvelopedData parsing

Brocade Security has become aware of a stack buffer overflow that could lead to a crash, causing Denial of Service, or potentially remote code execution. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an...

Rocky Linux Updates applied to SANnav (CVE-2024-3661, CVE-2024-11187, CVE-2024-12797)

Rocky Linux OS updates RSLA-2025:0377, RSLA-2025:1681, RLSA-2025:1330 applied to Brocade SANnav OVA OS CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic CVE-2024-11187 It is possible to construct a zone such that some queries to it will generate respons...

Vulnerability in OpenSSH when the VerifyHostKeyDNS option is enabled (CVE-2025-26465)

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

GNU tar mishandled extension attributes in a PAX archive

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c...

Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commands (CVE-2025-58381)

A vulnerability in Brocade Fabric OS before 9.2.1c2 could allow an authenticated attacker with admin privileges using the shell commands “source, ping6, sleep, disown, wait to modify the path variables and move upwards in the directory structure or to traverse to different directories...

Multiple Vulnerabilities in Apache Kafka

Multiple Vulnerabilities addressed in Apache Kafka CVE-2023-25194 A possible security vulnerability has been identified in Apache Kafka Connect. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a...

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVE-2025-12543)

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed withou...

Daily Data Dump Collector logs database password in cleartext when running docker exec commands (CVE-2025-6392)

Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec commands. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server...

Plaintext security passwords are logged in the audit logs while executing openssl cmd (CVE-2025-4662)

Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase from the command line or while providing the passphrase through a temporary file. These audit logs are the local server VM’s audit logs an...

Oracle Java SE Multiple Vulnerabilities (April 2025)

Oracle Java SE Multiple Vulnerabilities April 2025 CVE-2025-23083 CVSS 3.1 Base Score 7.7 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Brocade SANnav not affected: VEX Justification: Vulnerablecodecannotbecontolledbyadversary CVE-2024-54534 CVSS 3.1 Base Score 7.5 CVSS Vector:...

Spring Framework URL Parsing with Host Validation (CVE-2024-22243)

Applications that useUriComponentsBuilderto parse an externally provided URL e.g. through a query parameterAND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks. More at:...

BSA-2018-539

Security Advisory ID : BSA-2018-539 Component : OpenSSH Revision : 2.0: Final The resendbytes function in roamingcommon.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffe...

BSA-2017-355

Security Advisory ID : BSA-2017-355 Component : Stack Revision : 2.0: Interim A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to ju...

BSA-2017-337

Security Advisory ID : BSA-2017-337 Component : OpenVPN Revision : 2.0: Interim An authenticated client can do the 'three way handshake' PHARDRESET, PHARDRESET, PCONTROL, where the PCONTROL packet is the first that is allowed to carry payload. If that payload is too big, theOpenVPNserver process...

BSA-2017-335

Security Advisory ID : BSA-2017-335 Component : zlib Revision : 2.0: Interim The C standard says that bit shifts of negative integers is undefined. This casts to unsigned values to assure a known result. Affected Products Product| Current Assessment ---|--- Brocade Virtual Web Application Firewal...

BSA-2017-314

Security Advisory ID : BSA-2017-314 Component : WildFly Revision : 5.0: Final Incomplete blacklist vulnerability in the servlet filter restriction mechanism inWildFlyformerlyJBossApplication Server before 10.0.0.Final on Windows allows remote unauthenticated attackers to read sensitive files...

BSA-2017-331

Security Advisory ID : BSA-2017-331 Component : JAVA SE Security Revision : 3.0: Final Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121. Difficult to...

BSA-2017-267

Security Advisory ID : BSA-2017-267 Component : NTP Revision : 1.0: Interim Thecronjobscript bundled withntppackage is intended to perform cleanup on statistics files produced by NTP daemon running with statistics enabled. The script is run as root during the dailycronjobsall operations on...

BSA-2017-201

Security Advisory ID : BSA-2017-201 Component : OpenSSL Revision : 1.0: Interim It was found that function "ssl3readbytes" inssl/s3pkt.c might lead to higher CPU usage due to improper handling of warning packets.An attacker could repeat the undefined plaintext warning packets of "SSL3ALWARNING"...

BSA-2017-226

Security Advisory ID : BSA-2017-226 Component : ntp Revision : 1.0: Interim The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability inntpd'sbroadcast mode poll...

BSA-2017-218

Security Advisory ID : BSA-2017-218 Component : ntp Revision : 1.0: Interim tpddoes not enable trap service by default. If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crashntpd, resulting in a denial of...

GRUB2 Vulnerable to Out-of-Bounds Write via Network Boot Process in 'grub_strcpy()' Function

A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grubstrcpy function. During this step, it fails to consider the environment variable length...

Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0 (CVE-2025-12679)

A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption PBE key in plaintext in the system audit log file. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the pbe key. Note: The vulnerability is only triggered duri...

This flaw allows a malicious HTTP server to set "super cookies" in curl

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a...

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an...

Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service

CVE-2019-9704 Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service daemon crash via a large crontab file because the calloc return value is not checked. CVE-2019-9705 Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of...

DoS due to improper input validation vulnerability in Apache Tomcat - CVE-2024-24549

A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn't reset immediately. Instead, the reset action occurs only aft...

Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 (CVE-2026-0383)

A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file contents including the history command...

JSON Web Token (JWT) Exposure in Log Files

Brocade ASCG before 3.3.0 logs JSON Web Tokens JWT in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure. Note: The vulnerability affects both Brocade ASCG...

Ingress-nginx admission controller RCE escalation (CVE-2025-1974)

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5

e2fsprogs is vulnerable to memory corruption due to an out-of-bounds access issue when running the e2fsck utility. An attacker could exploit this vulnerability by supplying a system with a maliciously crafted filesystem image...

BSA-2018-737

Security Advisory ID : BSA-2018-737 Component : OpenSSL Revision : 2.0: Final The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a-dev...

BSA-2017-336

Security Advisory ID : BSA-2017-336 Component : zlib Revision : 2.0: Interim There was a small optimization for PowerPCs to pre-increment a pointer when accessing a word, instead of post-incrementing. This required prefacing the loop with a decrement of the pointer, possibly pointing before the...

BSA-2017-271

Security Advisory ID : BSA-2017-271 Component : MD5 Algorithm Revision : 1.0: Interim The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature...

BSA-2017-310

Security Advisory ID : BSA-2017-310 Component : Linux Kernel Revision : 1.0: Interim udp.cin the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of arecvsystem call with the MSGPEEK flag...

BSA-2017-223

Security Advisory ID : BSA-2017-223 Component : ntp Revision : 1.0: Interim Zero Origin timestamp problems were fixed by Bug 2945 in ntp-4.2.8p6. However, subsequent timestamp validation checks introduced a regression in the handling of some Zero origin timestamp checks. Affected Products Product...

BSA-2017-234

Security Advisory ID : BSA-2017-234 Component : Linux Kernel Revision : 2.0: Interim Race condition in net/packet/afpacket.cin the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service use-after-free by leveraging the CAPNETRAW capability to change a socke...