Most recent entries from all

ALSA-2025:3828 — Moderate: glibc security update

Affected: AlmaLinux:8: compat-libpthread-nonshared, AlmaLinux:8: glibc, AlmaLinux:8: glibc-all-langpacks, AlmaLinux:8: glibc-benchtests, AlmaLinux:8: glibc-common, AlmaLinux:8: glibc-devel, AlmaLinux:8: glibc-doc, AlmaLinux:8: glibc-gconv-extra, AlmaLinux:8: glibc-headers, AlmaLinux:8: glibc-langpack-aa and 204 more

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

* glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-01120

BELL-CVE-2025-0395

Affected: Alpaquita:23: glibc, Alpaquita:stream: glibc, BellSoft Hardened Containers:23: glibc, BellSoft Hardened Containers:stream: glibc

BREW-glibc-CVE-2025-0395

Affected: Homebrew: glibc

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

certfr-2025-avi-0524 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob…

certfr-2025-avi-0524

cnvd-2025-12277

EUVD-2026-317103

fkie_cve-2025-0395

GHSA-4xpw-6594-8f5m

ICSA-23-348-10 — Siemens SIMATIC S7-1500

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…

msrc_CVE-2025-0395 — When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the…

msrc_CVE-2025-0395

NCSC-2026-0147 — Kwetsbaarheden verholpen in Siemens-producten

NCSC-2026-0147

OESA-2025-1242 — glibc security update

Affected: openEuler:24.03-LTS: glibc, openEuler:24.03-LTS-SP1: glibc, openEuler:20.03-LTS-SP4: glibc, openEuler:22.03-LTS-SP3: glibc, openEuler:22.03-LTS-SP4: glibc

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more. Security Fix(es):

openSUSE-SU-2025:14851-1 — glibc-2.41-1.1 on GA media

glibc-2.41-1.1 on GA media

RHSA-2025:4241 — Red Hat Security Advisory: glibc security update

glibc: buffer overflow in the GNU C Library's assert()

SSA-577017 — SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data. In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem. Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution. An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call. An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length. An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case. An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length. An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply. An issue was discove…

SUSE-SU-2025:0510-1 — Security update for glibc

Security update for glibc

UBUNTU-CVE-2025-0395

Affected: Ubuntu:Pro:14.04:LTS: eglibc, Ubuntu:Pro:16.04:LTS: glibc, Ubuntu:Pro:18.04:LTS: glibc, Ubuntu:20.04:LTS: glibc, Ubuntu:22.04:LTS: glibc, Ubuntu:24.04:LTS: glibc

WID-SEC-W-2025-0172 — GNU libc: Schwachstelle ermöglicht Denial of Service

Ein lokaler Angreifer kann eine Schwachstelle in GNU libc ausnutzen, um einen Denial of Service Angriff durchzuführen.