Multiple security vulnerabilities were discovered in the Linux kernel for AWS systems, including a flaw known as VMSCAPE that involves insufficient branch predictor isolation between a guest VM and a userspace hypervisor on certain processors. This flaw could allow an attacker in a guest VM to potentially expose sensitive information from the host OS. Additional issues affect the HSI, Bluetooth, and Timer subsystems. These vulnerabilities could be used by an attacker to compromise the system. A security update addressing these issues is available and requires a system reboot and recompilation of third-party kernel modules due to an ABI change.
Red Hat OpenShift Container Platform 4.12.82 is a bug fix and security update release for Red Hat's Kubernetes application platform designed for on-premise or private cloud deployments. This advisory primarily provides updated container images and references an associated RPM package advisory. The update addresses several bugs and enhancements but does not include any new security fixes. Users are advised to upgrade to this release when available via the appropriate channels.
Multiple security vulnerabilities were discovered in the Linux kernel for Raspberry Pi systems, affecting subsystems such as Ext4 file system, NFS server daemon, packet sockets, network traffic control, and VMware vSockets driver. These issues could potentially allow an attacker to compromise the system. A patch fixing these vulnerabilities is available in version 5.4.0-1134.147~18.04.1. Users are advised to update and reboot their systems. Due to an ABI change, third-party kernel modules may need recompilation and reinstallation.
DSPy versions up to 3.0.3 have an overly permissive sandbox configuration that allows attackers to read sensitive files when users build AI agents using the PythonInterpreter class. This vulnerability could lead to unauthorized disclosure of sensitive information.
MantisBT versions prior to 2.27.2 are vulnerable to a denial-of-service condition caused by a lack of server-side validation on note length. Attackers can submit extremely long notes (tested with over 4.7 million characters) that corrupt the issue activity logs, rendering the entire activity stream unviewable and preventing new notes from displaying. This breaks collaboration on affected issues. The vulnerability is fixed in version 2.27.2.
Two security vulnerabilities affecting Redis 6 on Red Hat Enterprise Linux 8.4 have been addressed. The first involves Lua library commands that may cause an integer overflow leading to potential remote code execution (CVE-2025-46817). The second is a use-after-free vulnerability in Redis Lua that may also lead to remote code execution (CVE-2025-49844). Red Hat has released updated packages to fix these issues.
Red Hat OpenShift Container Platform 4.14.58 includes security updates addressing two vulnerabilities: a Server-Side Request Forgery (CVE-2024-6538) in the OpenShift Console and a prototype pollution vulnerability in DOMPurify (CVE-2024-48910). These issues affect the container images and RPM packages of this release. Users of OpenShift Container Platform 4.14 are advised to upgrade to this release to mitigate these security risks.
Starlette versions from 0.39.0 up to but not including 0.49.1 contain a vulnerability in the FileResponse component where processing of crafted HTTP Range headers triggers quadratic-time complexity. This can lead to CPU exhaustion and denial-of-service (DoS) conditions on endpoints serving files, including StaticFiles and any direct use of FileResponse. The vulnerability arises from inefficient parsing and merging of multiple range requests, allowing an unauthenticated attacker to cause high CPU usage with a single request.
Multiple security vulnerabilities were discovered in the Linux kernel version linux-oracle-6.8 affecting a wide range of subsystems including architectures (ARM32, ARM64, x86), various drivers, filesystems, networking protocols, and kernel infrastructure components. These vulnerabilities could potentially allow an attacker to compromise the system. A security update fixing these issues is available and requires a system reboot and recompilation of third-party kernel modules due to ABI changes.
Multiple security vulnerabilities were identified in the Linux kernel for the Azure platform, affecting various subsystems including network drivers, file systems, and protocol implementations. These flaws could potentially allow an attacker to compromise the system. A security update addressing these issues has been released and requires a system reboot and recompilation of third-party kernel modules due to ABI changes.
Multiple security vulnerabilities were discovered in the Linux kernel for Oracle Cloud systems affecting subsystems including Ext4 file system, NFS server daemon, packet sockets, network traffic control, and VMware vSockets driver. These flaws could potentially allow an attacker to compromise the system. A security update correcting these issues is available and requires a system reboot and recompilation of third-party kernel modules due to an ABI change.