https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:30:25 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:12100 <p><strong>Affected:</strong> AlmaLinux:9: libtpms</p> <p>The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.</p> <p>Security Fix(es):</p> <p>* libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: libtpms</p> <p>The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.</p> <p>Security Fix(es):</p> <p>* libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:12100 https://cve.radiocsirt.org/vuln/bdu:2025-11088 bdu:2025-11088 https://cve.radiocsirt.org/vuln/bdu:2025-11088 https://cve.radiocsirt.org/vuln/essa-2025:3052 <p>Moderate: virt:rhel and virt-devel:rhel security update</p> <p>Moderate: virt:rhel and virt-devel:rhel security update</p> https://cve.radiocsirt.org/vuln/essa-2025:3052 https://cve.radiocsirt.org/vuln/euvd-2026-257969 EUVD-2026-257969 https://cve.radiocsirt.org/vuln/euvd-2026-257969 https://cve.radiocsirt.org/vuln/fkie_cve-2025-49133 <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &#34;Part 4: Supporting Routines – Code&#34; document, section &#34;7.151 - /tpm/src/crypt/CryptUtil.c &#34;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.</p> <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &#34;Part 4: Supporting Routines – Code&#34; document, section &#34;7.151 - /tpm/src/crypt/CryptUtil.c &#34;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-49133 https://cve.radiocsirt.org/vuln/msrc_cve-2025-49133 msrc_CVE-2025-49133 https://cve.radiocsirt.org/vuln/msrc_cve-2025-49133 https://cve.radiocsirt.org/vuln/oesa-2025-1836 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libtpms</p> <p>A library providing TPM functionality for VMs. Targeted for integration into Qemu. Security Fix(es):</p> <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &amp;quot;Part 4: Supporting Routines – Code&amp;quot; document, section &amp;quot;7.151 - /tpm/src/crypt/CryptUtil.c &amp;quot;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.(CVE-2025-49133)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: libtpms</p> <p>A library providing TPM functionality for VMs. Targeted for integration into Qemu. Security Fix(es):</p> <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &amp;quot;Part 4: Supporting Routines – Code&amp;quot; document, section &amp;quot;7.151 - /tpm/src/crypt/CryptUtil.c &amp;quot;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.(CVE-2025-49133)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1836 https://cve.radiocsirt.org/vuln/rhsa-2025:12111 <p>libtpms: Libtpms Out-of-Bounds Read Vulnerability</p> <p>libtpms: Libtpms Out-of-Bounds Read Vulnerability</p> https://cve.radiocsirt.org/vuln/rhsa-2025:12111 https://cve.radiocsirt.org/vuln/suse-su-2026:21035-1 <p>Security update for libtpms</p> <p>Security update for libtpms</p> https://cve.radiocsirt.org/vuln/suse-su-2026:21035-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49133 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: libtpms, Ubuntu:24.04:LTS: libtpms</p> <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &#34;Part 4: Supporting Routines – Code&#34; document, section &#34;7.151 - /tpm/src/crypt/CryptUtil.c &#34;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: libtpms, Ubuntu:24.04:LTS: libtpms</p> <p>Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the &#34;Part 4: Supporting Routines – Code&#34; document, section &#34;7.151 - /tpm/src/crypt/CryptUtil.c &#34;. This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-49133 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1669 <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1669