MSVSphere OS Errata System 1 5.10 2025-12-07T20:26:45 MSVSphere OS 10 FastCGI Perl bindings. * CVE-2025-40907 A flaw was found in the FCGI library. In affected versions, specially crafted nameLen or valueLen values in data sent to the IPC socket may result in a heap-based buffer overflow, which can cause an application crash or other undefined behavior. This occurs in ReadParams in fcgiapp.c. Important Copyright 2025 Softline PJSC CVE-2025-40907 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. * CVE-2025-24813 A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. * CVE-2024-52316 A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process. * CVE-2024-54677 A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2024-52316 CVE-2024-54677 CVE-2025-24813 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. * CVE-2025-31492 A flaw was found in mod_auth_openidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present. Important Copyright 2025 Softline PJSC CVE-2025-31492 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC CVE-2025-22871 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. * CVE-2025-48734 A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like getProperty() or getNestedProperty(). Important Copyright 2025 Softline PJSC CVE-2025-48734 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-22869 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. * CVE-2025-27144 A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Important Copyright 2025 Softline PJSC CVE-2025-22869 CVE-2025-27144 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. * CVE-2024-52005 A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information or to mislead the user into executing untrusted scripts. Moderate Copyright 2025 Softline PJSC CVE-2024-52005 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID. * CVE-2025-6019 A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Important Copyright 2025 Softline PJSC CVE-2025-6019 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster software. * CVE-2025-30472 A flaw was found in Corosync. In affected versions, a stack-based buffer overflow may be triggered via a large UDP packet in configurations where encryption is disabled or if an attacker knows the encryption key. This issue can lead to an application crash or other undefined behavior. Moderate Copyright 2025 Softline PJSC CVE-2025-30472 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-3028 JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability affects Firefox < 137, Firefox ESR < 115.22, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. * CVE-2025-3029 A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. * CVE-2025-3030 Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 137, Firefox ESR < 128.9, Thunderbird < 137, and Thunderbird < 128.9. Important Copyright 2025 Softline PJSC CVE-2025-3028 CVE-2025-3029 CVE-2025-3030 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. * CVE-2024-11235 A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the __set magic method or the null coalescing assignment (??=) operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout through specially crafted inputs. * CVE-2025-1217 A flaw was found in PHP. This vulnerability allows misinterpretation of HTTP response headers, potentially leading to incorrect usage of headers, MIME types, and other response attributes via incorrect parsing of folded headers in the HTTP request module. * CVE-2025-1219 A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling. * CVE-2025-1734 A flaw was found in PHP. This vulnerability allows applications to accept invalid headers via malformed HTTP headers missing a colon (:), which may confuse applications into processing them as valid headers. * CVE-2025-1736 A flaw was found in PHP. This vulnerability allows certain headers to be either not sent or misinterpreted due to insufficient validation of the end-of-line characters via user-supplied headers. * CVE-2025-1861 A flaw was found in PHP. This vulnerability allows incorrect URL truncation and redirection to the wrong location via HTTP redirect handling due to a limited location buffer size. Important Copyright 2025 Softline PJSC CVE-2024-11235 CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1736 CVE-2025-1861 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Collector with the supported components for a Red Hat build of OpenTelemetry * CVE-2025-30204 A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service. * CVE-2025-27144 A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. * CVE-2025-22868 An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. * CVE-2025-29786 A flaw was found in Expr. This vulnerability allows excessive memory usage and potential out-of-memory (OOM) crashes via unbounded input strings, where a malicious or inadvertent large expression can cause the parser to construct an extremely large Abstract Syntax Tree (AST), consuming excessive memory. Important Copyright 2025 Softline PJSC CVE-2025-22868 CVE-2025-29786 CVE-2025-30204 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. * CVE-2025-25724 A flaw was found in the libarchive package. Affected versions of libarchive do not check a strftime return value, which can lead to a denial of service or unspecified other impacts via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale. Moderate Copyright 2025 Softline PJSC CVE-2025-25724 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). * CVE-2025-3576 A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering. Moderate Copyright 2025 Softline PJSC CVE-2025-3576 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-5263 Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5264 Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5266 Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5267 A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5268 Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5269 Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11. * CVE-2025-5283 Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important Copyright 2025 Softline PJSC CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 CVE-2025-5283 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. * CVE-2025-27144 A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. * CVE-2025-5455 A flaw was found in QtCore's qDecodeDataUrl() function. This vulnerability allows an application level denial of service via a malformed data URL with a missing charset value when assertions are enabled. Moderate Copyright 2025 Softline PJSC CVE-2025-5455 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. * CVE-2025-27144 A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Expat is a C library for parsing XML documents. * CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. Moderate Copyright 2025 Softline PJSC CVE-2024-8176 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. * CVE-2025-26623 A heap overflow vulnerability was found in the Exiv2 library. In affected versions, the issue is triggered when Exiv2 is used to write metadata into a crafted image file. This could allow an attacker to execute code if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. Moderate Copyright 2025 Softline PJSC CVE-2025-26623 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. * CVE-2025-31115 A flaw was found in the XZ Utils library. In affected versions, the multithreaded .xz decoder in liblzma has a bug where invalid input can trigger a heap use-after-free condition, allowing writes to an address based on the null pointer plus an offset. This issue may result in a crash or other undefined behavior. Applications and libraries that use the lzma_stream_decoder_mt function are affected. Important Copyright 2025 Softline PJSC CVE-2025-31115 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. * CVE-2025-27832 An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. Moderate Copyright 2025 Softline PJSC CVE-2025-27832 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The golang packages provide the Go programming language compiler. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-4918 An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2. * CVE-2025-4919 An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2. * CVE-2025-5263 Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5264 Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5266 Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5267 A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5268 Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. * CVE-2025-5269 Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11. * CVE-2025-5283 Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. * CVE-2025-47905 Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries. Important Copyright 2025 Softline PJSC CVE-2025-47905 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. * CVE-2025-5283 Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. * CVE-2024-55549 xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. * CVE-2025-24855 numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. Important Copyright 2025 Softline PJSC CVE-2024-55549 CVE-2025-24855 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2025-27516 A flaw was found in Jinja. In affected versions, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker who controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. Important Copyright 2025 Softline PJSC CVE-2025-27516 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Perl is a high-level programming language that is commonly used for system administration utilities and web programming. * CVE-2024-56406 A flaw was found in Perl. This vulnerability allows a heap buffer overflow, which can lead to denial of service and potential arbitrary code execution on platforms that lack sufficient defenses via specially crafted input to the tr/// transliteration operator containing non-ASCII bytes on the left-hand side. Important Copyright 2025 Softline PJSC CVE-2024-56406 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. * CVE-2025-25186 A flaw was found in Ruby's net-imap library. In certain versions, there is a possibility for denial of service by memory exhaustion in the net-imap response parser. At any time while the client is connected, a malicious server can send highly compressed uid-set data, which is automatically read by the client's receiver thread. The response parser converts the uid-set data into arrays of integers with no limitation on the expanded size of the ranges, which can trigger memory exhaustion. * CVE-2025-27219 A flaw was found in Ruby's CGI gem. Processing specially crafted large cookies with the CGI::Cookie.parse method can cause excessive resource consumption due to a missing limit on the length of the raw cookie value, resulting in a denial of service. * CVE-2025-27221 A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak can occur. Moderate Copyright 2025 Softline PJSC CVE-2025-25186 CVE-2025-27219 CVE-2025-27221 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2025-47287 A flaw was found in Tornado. This vulnerability can lead to a a denial of service by generating an extremely high volume of log entries. Important Copyright 2025 Softline PJSC CVE-2025-47287 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17. * CVE-2025-30399 Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. Important Copyright 2025 Softline PJSC CVE-2025-30399 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. * CVE-2025-30204 A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. * CVE-2025-4123 A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive. Important Copyright 2025 Softline PJSC CVE-2025-4123 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16. * CVE-2025-26646 External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. Important Copyright 2025 Softline PJSC CVE-2025-26646 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5. * CVE-2025-26646 External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. * CVE-2024-8508 A flaw was found in Unbound which can lead to degraded performance and an eventual denial of service when handling replies with very large RRsets that require name compression to be applied. Versions prior to 1.21.1 do not have a hard limit on the number of name compression calculations that Unbound can perform per packet, meaning that if a specially crafted query is passed for the contents of a malicious zone with very large RRsets, Unbound may spend a considerable amount of time applying name compression to downstream replies, locking the CPU until the whole packet has been processed. Moderate Copyright 2025 Softline PJSC CVE-2024-8508 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-4918 An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2. * CVE-2025-4919 An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, Firefox ESR < 115.23.1, Thunderbird < 128.10.2, and Thunderbird < 138.0.2. Important Copyright 2025 Softline PJSC CVE-2025-4918 CVE-2025-4919 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. * CVE-2024-45336 The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. * CVE-2024-45341 A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. * CVE-2025-22866 Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols. Moderate Copyright 2025 Softline PJSC CVE-2024-45341 CVE-2025-22866 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. * CVE-2024-57970 A flaw was found in the libarchive library. A specially-crafted tar file may trigger a head-based buffer over-read condition due to incorrect handling of truncation in the middle of a long GNU linkname. This issue can cause an application crash leading to a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2024-57970 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. * CVE-2025-22869 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. * CVE-2025-30204 A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. * CVE-2025-46727 A flaw was found in Rack::QueryParser. This vulnerability allows denial of service via oversized HTTP requests containing many parameters, resulting in memory exhaustion that consumes all available memory or CPU resource pinning, which keeps the CPU constantly busy. Important Copyright 2025 Softline PJSC CVE-2025-46727 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-3875 Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. * CVE-2025-3877 A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data, such as using /dev/urandom on Linux, or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. * CVE-2025-3909 Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. * CVE-2025-3932 It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1. Important Copyright 2025 Softline PJSC CVE-2025-3875 CVE-2025-3877 CVE-2025-3909 CVE-2025-3932 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. * CVE-2025-3887 A flaw was found in GStreamer H265 Codec Parsing. This vulnerability allows remote attackers to execute arbitrary code by parsing H265 slice headers. Important Copyright 2025 Softline PJSC CVE-2025-3887 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6. * CVE-2025-30399 Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality. * CVE-2024-10306 A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic. Moderate Copyright 2025 Softline PJSC CVE-2024-10306 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Xwayland is an X server for running X clients under Wayland. * CVE-2025-49175 A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash. * CVE-2025-49176 A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check. * CVE-2025-49178 A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service. * CVE-2025-49179 A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks. * CVE-2025-49180 A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate. * CVE-2025-49177 A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests. Important Copyright 2025 Softline PJSC CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. * CVE-2025-4404 A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration. Important Copyright 2025 Softline PJSC CVE-2025-4404 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Xwayland is an X server for running X clients under Wayland. * CVE-2024-9632 A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges. * CVE-2025-26594 A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. * CVE-2025-26595 A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size. * CVE-2025-26596 A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow. * CVE-2025-26597 A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size. * CVE-2025-26598 An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access. * CVE-2025-26599 An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later. * CVE-2025-26600 A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free. * CVE-2025-26601 A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers. Important Copyright 2025 Softline PJSC CVE-2024-9632 CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597 CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-2830 By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. * CVE-2025-3522 Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. * CVE-2025-3523 When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. * CVE-2025-2817 Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4083 A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4087 A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4091 Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4093 Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird < 128.10. Important Copyright 2025 Softline PJSC CVE-2025-2817 CVE-2025-2830 CVE-2025-3522 CVE-2025-3523 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The iputils packages contain basic utilities for monitoring a network, including ping. * CVE-2025-47268 A flaw was found in iputils ping, where a signed integer overflow occurs in timestamp multiplication. This issue could lead to incorrect timestamp calculations or denial of service when processing crafted ICMP Echo Reply packets. Moderate Copyright 2025 Softline PJSC CVE-2025-47268 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. * CVE-2025-3277 SQLite could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the concat_ws() function. Important Copyright 2025 Softline PJSC CVE-2025-3277 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. * CVE-2024-46951 An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution. * CVE-2024-46952 An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values). * CVE-2024-46953 An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution. * CVE-2024-46954 A flaw was found in Ghostscript/base/gp_utf8.c. This vulnerability allows directory traversal via overlong UTF-8 encoding, potentially leading to unauthorized access to filesystem directories. * CVE-2024-46956 A flaw was found in Artifex Ghostscript's psi/zfile.c component. This vulnerability allows arbitrary code execution via out-of-bounds data access. Moderate Copyright 2025 Softline PJSC CVE-2024-46951 CVE-2024-46952 CVE-2024-46953 CVE-2024-46954 CVE-2024-46956 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The OpenJDK 21 runtime environment. * CVE-2025-21587 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. * CVE-2025-30691 Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. * CVE-2025-30698 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK: 17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition: 20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). Moderate Copyright 2025 Softline PJSC CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. * CVE-2025-23166 A flaw was found in Node.js, specifically in the C++ method SignTraits::DeriveBits(). This vulnerability can allow a remote attacker to crash the Node.js runtime via untrusted input, triggering an exception in a background thread. * CVE-2025-23165 A flaw was found in the ReadFileUtf8 internal binding of Node.js. This vulnerability can allow an attacker to cause an application denial of service via repeated file read operations that trigger an unrecoverable memory leak due to a corrupted pointer in the underlying file system binding. Important Copyright 2025 Softline PJSC CVE-2025-23165 CVE-2025-23166 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. * CVE-2025-32907 A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service. * CVE-2025-32049 A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS). * CVE-2025-4948 A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart messages. Due to improper validation, an internal calculation can go wrong, leading to an integer underflow. This can cause the program to access invalid memory and crash. As a result, any application or server using libsoup could be forced to exit unexpectedly, creating a denial-of-service (DoS) risk. * CVE-2025-4035 A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation. Important Copyright 2025 Softline PJSC CVE-2025-32049 CVE-2025-32907 CVE-2025-4035 CVE-2025-4948 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. * CVE-2025-32906 A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server. * CVE-2025-46421 A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. * CVE-2025-2784 A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. * CVE-2025-32914 A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds. * CVE-2025-32908 A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS). * CVE-2025-32912 A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash. Important Copyright 2025 Softline PJSC CVE-2025-2784 CVE-2025-32906 CVE-2025-32908 CVE-2025-32912 CVE-2025-32914 CVE-2025-46421 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. * CVE-2025-31498 A flaw was found in c-ares. This vulnerability allows a remote or local attacker to cause a use-after-free, potentially leading to application-level denial of service or other unexpected behavior via manipulation of DNS responses or network conditions during query processing. Moderate Copyright 2025 Softline PJSC CVE-2025-31498 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. * CVE-2025-5024 A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd. Moderate Copyright 2025 Softline PJSC CVE-2025-5024 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2025-47273 A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools. Moderate Copyright 2025 Softline PJSC CVE-2025-47273 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-6424 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. * CVE-2025-6425 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser and persisted between containers and normal/private browsing mode but not profiles. * CVE-2025-6429 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. * CVE-2025-6430 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scripting attack. Important Copyright 2025 Softline PJSC CVE-2025-6424 CVE-2025-6425 CVE-2025-6429 CVE-2025-6430 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-6424 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. * CVE-2025-6425 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser and persisted between containers and normal/private browsing mode but not profiles. * CVE-2025-6429 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. * CVE-2025-6430 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scripting attack. * CVE-2025-5986 A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. Important Copyright 2025 Softline PJSC CVE-2025-5986 CVE-2025-6424 CVE-2025-6425 CVE-2025-6429 CVE-2025-6430 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. * CVE-2025-5702 A flaw was found in the optimized strcmp glibc function for the Power10 CPU architecture. GNU C library versions from 2.39 onward overwrite two vector registers in a way that can disrupt the control flow of a program. Moderate Copyright 2025 Softline PJSC CVE-2025-5702 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. * CVE-2024-52533 A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4_CONN_MSG_LEN. This issue may lead to an application crash or other undefined behavior. * CVE-2025-4373 A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite. Moderate Copyright 2025 Softline PJSC CVE-2024-52533 CVE-2025-4373 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. * CVE-2025-32801 Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. * CVE-2025-32802 Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8. * CVE-2025-32803 A vulnerability was found in the Kea package, where an attacker with access to a local unprivileged user may be able to read the logs and DHCP lease information. This can be used to retrieve sensitive information about the DHCP clients and about the Kea process itself. Important Copyright 2025 Softline PJSC CVE-2025-32801 CVE-2025-32802 CVE-2025-32803 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. * CVE-2025-4478 A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system. Moderate Copyright 2025 Softline PJSC CVE-2025-4478 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. * CVE-2025-21605 A flaw was found in the Redis server. This flaw allows an unauthenticated client to cause an unlimited growth of output buffers until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted, and the memory is unavailable. When password authentication is enabled on the Redis server but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system runs out of memory. Important Copyright 2025 Softline PJSC CVE-2025-21605 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 libxml2 is a software library written in C for parsing and manipulating Extensible Markup Language (XML) documents. It's a core component of the GNOME project, but can be used independently in other software projects. libxml2 provides functionalities for reading, creating, and modifying XML data, and also supports standards like XML, Namespaces, XPath, and XPointer. * CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible. Critical Copyright 2025 Softline PJSC CVE-2024-40896 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 rpm-ostree is a hybrid image and package system that combines libostree for image-based updates with RPM for package management. It allows for atomic updates, where the entire operating system is updated as a single unit, and also supports layering additional packages on top of the base image. This approach provides a balance between the stability of image-based systems and the flexibility of package-based systems. * CVE-2024-2905 A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access. Moderate Copyright 2025 Softline PJSC CVE-2024-2905 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. * CVE-2024-45336 A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. * CVE-2025-3931 A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentication and authorization checks, allowing every system user to call it. One available Yggdrasil worker acts as a package manager with capabilities to create and enable new repositories and install or remove packages. This flaw allows an attacker with access to the system to leverage the lack of authentication on the dispatch message to force the Yggdrasil worker to install arbitrary RPM packages. This issue results in local privilege escalation, enabling the attacker to access and modify sensitive system data. Important Copyright 2025 Softline PJSC CVE-2024-45336 CVE-2025-3931 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. * CVE-2025-1492 A flaw was found in Wireshark. Bundle Protocol and CBOR dissector crashes in Wireshark allow denial of service via packet injection or crafted capture file. Moderate Copyright 2025 Softline PJSC CVE-2025-1492 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-2817 Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4083 A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4087 A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4091 Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10. * CVE-2025-4093 Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird < 128.10. Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. * CVE-2025-24813 A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. Moderate Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 libndp is a library that provides a wrapper for the IPv6 Neighbor Discovery Protocol (NDP). It's essentially a toolset that allows developers and system administrators to work with NDP, enabling them to send and receive NDP messages, build and parse NDP packets, and manage network connections on IPv6 networks. * CVE-2024-5564 A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information. Important Copyright 2025 Softline PJSC CVE-2024-5564 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The golang packages provide the Go programming language compiler. * CVE-2025-4673 A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties. Moderate Copyright 2025 Softline PJSC CVE-2025-4673 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 rsyncd is the daemon (server) version of the rsync utility, which is used for synchronizing files between computers. It allows rsync to run as a service, listening for incoming connections and transferring files based on its configuration. * CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. Critical Copyright 2025 Softline PJSC CVE-2024-12084 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-6032 A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack. Important Copyright 2025 Softline PJSC CVE-2025-6032 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2024-12718 A flaw was found in CPython's tarfile module. This vulnerability allows modification of file metadata, such as timestamps or permissions, outside the intended extraction directory via maliciously crafted tar archives using the filter="data" or filter="tar" extraction filters. * CVE-2025-4138 A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract() or TarFile.extractall() with the filter= parameter set to "data" or "tar". * CVE-2025-4330 A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall() or TarFile.extract() with the filter="data" or filter="tar" parameters. This issue leads to potentially overwriting or modifying system files and metadata. * CVE-2025-4435 A flaw was found in CPython's tarfile module. This vulnerability allows unauthorized file extraction via crafted tar archives when TarFile.errorlevel=0, bypassing expected filtering mechanisms. * CVE-2025-4517 A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall() or TarFile.extract() methods with the extraction filter parameter set to "data" or "tar". Important Copyright 2025 Softline PJSC CVE-2024-12718 CVE-2025-4138 CVE-2025-4330 CVE-2025-4435 CVE-2025-4517 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. * CVE-2024-6174 An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure. Important Copyright 2025 Softline PJSC CVE-2024-6174 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libxml2 library is a development toolbox providing the implementation of various XML standards. * CVE-2025-49794 A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. * CVE-2025-49796 A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory. * CVE-2025-6021 A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. * CVE-2025-49795 A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-49794 CVE-2025-49795 CVE-2025-49796 CVE-2025-6021 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. * CVE-2024-56337 A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution. * CVE-2025-31650 A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service (DoS), causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak. Important Copyright 2025 Softline PJSC CVE-2024-56337 CVE-2025-31650 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality. * CVE-2024-10306 A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic. Moderate Copyright 2025 Softline PJSC CVE-2024-10306 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. * CVE-2025-32023 Redis could allow a local authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw in hyperloglog commands. * CVE-2025-48367 Redis is vulnerable to a denial of service, caused by a bad connection error handling. * CVE-2025-27151 Redis is vulnerable to a denial of service, caused by a stack-based buffer overflow in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and possibly achieve code execution. Important Copyright 2025 Softline PJSC CVE-2025-27151 CVE-2025-32023 CVE-2025-48367 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. * CVE-2024-50349 A flaw was found in Git. This vulnerability occurs when Git requests credentials via a terminal prompt, for example, without the use of a credential helper. During this process, Git displays the host name for which the credentials are needed, but any URL-encoded parts are decoded and displayed directly. This can allow an attacker to manipulate URLs by including ANSI escape sequences, which can be interpreted by the terminal to mislead users by tricking them into entering passwords that are redirected to malicious attacker-controlled sites. * CVE-2024-52006 A flaw was found in Git. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems, most notably .NET and node.js, interpret single Carriage Return characters as newlines, which render the protections against CVE-2020-5260 incomplete for credential helpers, which has the potential to expose stored credentials to malicious URLs. * CVE-2025-27613 A vulnerability has been identified in the gitk application that could lead to unauthorized file modification or data loss. * CVE-2025-27614 Git could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper input validation of gitk filename. * CVE-2025-46835 A vulnerability was found in the git GUI package. When a user clones an untrusted repository and edits a file located in a maliciously named directory, git GUI may end up creating or overwriting arbitrary files for the running user has written permission. This flaw allows an attacker to modify the content of target files without the affected user's intent, resulting in a data integrity issue. * CVE-2025-48384 A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return (CR) are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read, resulting in the submodule being checked out to an incorrect location. * CVE-2025-48385 A bundled uri handling flaw was found in Git. When cloning a repository, Git knows to optionally fetch a bundle advertised by the remote server, which allows the server side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. Important Copyright 2025 Softline PJSC CVE-2024-50349 CVE-2024-52006 CVE-2025-27613 CVE-2025-27614 CVE-2025-46835 CVE-2025-48384 CVE-2025-48385 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. * CVE-2025-32462 A privilege escalation vulnerability was found in Sudo. In certain configurations, unauthorized users can gain elevated system privileges via the Sudo host option (-h or --host). When using the default sudo security policy plugin (sudoers), the host option is intended to be used in conjunction with the list option (-l or --list) to determine what permissions a user has on a different system. However, this restriction can be bypassed, allowing a user to elevate their privileges on one system to the privileges they may have on a different system, effectively ignoring the host identifier in any sudoers rules. This vulnerability is particularly impactful for systems that share a single sudoers configuration file across multiple computers or use network-based user directories, such as LDAP, to provide sudoers rules on a system. * CVE-2025-32463 A flaw was found in Sudo. This flaw allows a local attacker to escalate their privileges by tricking Sudo into loading an arbitrary shared library using the user-specified root directory via the "-R" ("--chroot") option. An attacker can run arbitrary commands as root on systems that support /etc/nsswitch.conf. Important Copyright 2025 Softline PJSC CVE-2025-32462 CVE-2025-32463 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites. * CVE-2024-12797 A flaw was found in OpenSSL's RFC7250 Raw Public Key (RPK) authentication. This vulnerability allows man-in-the-middle (MITM) attacks via failure to abort TLS/DTLS handshakes when the server's RPK does not match the expected key despite the SSL_VERIFY_PEER verification mode being set. Important Copyright 2025 Softline PJSC CVE-2024-12797 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-8027 Mozilla Firefox could allow a remote attacker to obtain sensitive information. The JavaScript engine only wrote partial return value to stack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to obtain sensitive information. * CVE-2025-8028 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: On arm64, a WASM br_table instruction with a large number of entries could lead to the label being too far from the instruction, causing truncation and incorrect computation of the branch address. * CVE-2025-8029 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags. * CVE-2025-8030 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by insufficient escaping in the “Copy as cURL” feature. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-8031 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by incorrect URL stripping in CSP reports. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-8032 Mozilla Firefox could allow a remote attacker to bypass security restrictions. The XSLT document loading did not correctly propagate the source document which bypassed its CSP. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-8033 Mozilla Firefox is vulnerable to a denial of service, caused by the incorrect JavaScript state machine for generators. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to trigger a NULL pointer dereference error. * CVE-2025-8034 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-8035 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. * CVE-2025-6965 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. Important Copyright 2025 Softline PJSC CVE-2025-6965 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-8027 Mozilla Firefox could allow a remote attacker to obtain sensitive information. The JavaScript engine only wrote partial return value to stack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to obtain sensitive information. * CVE-2025-8028 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: On arm64, a WASM br_table instruction with a large number of entries could lead to the label being too far from the instruction, causing truncation and incorrect computation of the branch address. * CVE-2025-8029 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags. * CVE-2025-8030 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by insufficient escaping in the “Copy as cURL” feature. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-8031 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by incorrect URL stripping in CSP reports. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-8032 Mozilla Firefox could allow a remote attacker to bypass security restrictions. The XSLT document loading did not correctly propagate the source document which bypassed its CSP. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-8033 Mozilla Firefox is vulnerable to a denial of service, caused by the incorrect JavaScript state machine for generators. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to trigger a NULL pointer dereference error. * CVE-2025-8034 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-8035 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. * CVE-2025-5994 A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet (ECS) must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS transaction ID with cache non-ECS poisoned replies. Important Copyright 2025 Softline PJSC CVE-2025-5994 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Perl is a high-level programming language that is commonly used for system administration utilities and web programming. * CVE-2025-40909 A flaw was found in the Perl standard library threads component. This vulnerability can allow a local attacker to exploit a race condition in directory handling to access files or load code from unexpected locations. Moderate Copyright 2025 Softline PJSC CVE-2025-40909 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. * CVE-2025-5222 A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution. Moderate Copyright 2025 Softline PJSC CVE-2025-5222 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. * CVE-2025-8058 A double-free vulnerability has been discovered in glibc (GNU C Library). This flaw occurs during bracket expression parsing within the regcomp function, specifically when a memory allocation failure takes place. Exploitation of a double-free vulnerability can lead to memory corruption, which could enable an attacker to achieve arbitrary code execution or a denial of service condition. Moderate Copyright 2025 Softline PJSC CVE-2025-8058 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. * CVE-2024-23337 Integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. * CVE-2025-48060 A flaw was found in jq, a command line JSON processor. A specially crafted input can cause a heap-based buffer over-read when formatting an empty string because it was not properly null-terminated, causing a crash and resulting in a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2024-23337 CVE-2025-48060 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. * CVE-2025-7345 A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution. Moderate Copyright 2025 Softline PJSC CVE-2025-7345 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Collector with the supported components for a Red Hat build of OpenTelemetry * CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. Moderate Copyright 2025 Softline PJSC CVE-2025-22871 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libxml2 library is a development toolbox providing the implementation of various XML standards. * CVE-2025-32414 In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters. * CVE-2025-32415 A flaw was found in the libxml2 library. A heap-based underflow can be triggered when a crafted XML document is validated against an XML schema with certain identity constraints or when a crafted XML schema is used, causing a crash to the application linked to the library and resulting in a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2025-32414 CVE-2025-32415 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2024-47081 A flaw was found in the Requests HTTP library. This vulnerability allows leakage of .netrc credentials to third parties via maliciously crafted URLs that exploit a URL parsing issue. Moderate Copyright 2025 Softline PJSC CVE-2024-47081 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. * CVE-2025-23266 A flaw was found in the NVIDIA Container Toolkit. This vulnerability allows execution of arbitrary code with elevated permissions via improperly secured container initialization hooks. This can potentially lead to privilege escalation, data tampering, information disclosure, and denial of service. Important Copyright 2025 Softline PJSC CVE-2025-23266 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. * CVE-2025-54874 An out-of-bounds heap memory write (OOB) flaw was found in OpenJPEG. A call to opj_jp2_read_header may lead to an OOB heap memory write when the data stream p_stream is too short and p_image is not initialized. Important Copyright 2025 Softline PJSC CVE-2025-54874 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The golang packages provide the Go programming language compiler. * CVE-2025-4674 A flaw was found in cmd/go. The go command can execute arbitrary commands when processing untrusted version control system (VCS) repositories containing malicious configuration. This issue occurs because the command interprets VCS metadata, potentially leading to unintended command execution. This vulnerability allows a malicious actor to trigger this by providing a repository with a crafted VCS configuration, resulting in arbitrary code execution within the context of the go process. Important Copyright 2025 Softline PJSC CVE-2025-4674 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. * CVE-2025-5914 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. Important Copyright 2025 Softline PJSC CVE-2025-5914 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. * CVE-2025-48988 A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition. * CVE-2025-48989 A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS). * CVE-2025-49125 A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths. * CVE-2025-52434 A denial of service flaw was found in Apache Tomcat. A race condition during connection closure could trigger a JVM crash when using the APR/Native connector, leading to a denial of service. This issue was particularly noticeable with client-initiated closures of HTTP/2 connections. * CVE-2025-52520 A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits. * CVE-2025-53506 A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service. * CVE-2025-48976 A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-48976 CVE-2025-48988 CVE-2025-48989 CVE-2025-49125 CVE-2025-52434 CVE-2025-52520 CVE-2025-53506 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. * CVE-2025-48988 A denial-of-service (DoS) vulnerability has been identified in Apache Tomcat, concerning its handling of upload limits. A remote attacker could exploit this flaw by sending a specially crafted request containing an excessively large number of multipart sections. This malicious request can trigger excessive memory consumption on the Tomcat server, ultimately leading to resource exhaustion and a denial-of-service condition. * CVE-2025-48989 A flaw was found in Apache Tomcat where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS). * CVE-2025-49125 A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths. * CVE-2025-52520 A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits. * CVE-2025-53506 A denial of service flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability, where an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams, could result in a denial of service. * CVE-2025-48976 A denial-of-service (DoS) vulnerability has been discovered in the Apache Commons FileUpload library. The flaw stems from insufficient limits placed on multipart headers during file uploads. A remote attacker could exploit this by sending a specially crafted request with an excessively large number of multipart headers. This malicious input can lead to uncontrolled memory consumption within applications utilizing the library, exhausting system resources and causing a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-48976 CVE-2025-48988 CVE-2025-48989 CVE-2025-49125 CVE-2025-52520 CVE-2025-53506 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. * CVE-2025-49630 An assertion failure flaw was found in Apache httpd. Untrusted clients can send inputs that trigger an assertion failure in the mod_proxy_http2 module, which likely results in an Apache HTTP server crash or denial of service (DoS). Moderate Copyright 2025 Softline PJSC CVE-2025-49630 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. * CVE-2025-8714 A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pg_dump, pg_dumpall, and pg_restore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to untrusted data inclusion. * CVE-2025-8715 A flaw was found in PostgreSQL. This vulnerability allows a malicious user of the PostgreSQL server to inject arbitrary code in dump files created by pg_dump, pg_dumpall, pg_restore, and pg_upgrade, causing arbitrary code execution on the client machine or SQL injection when these dump files are restored by psql due to an improper neutralization of newlines. Important Copyright 2025 Softline PJSC CVE-2025-8714 CVE-2025-8715 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. * CVE-2024-47252 A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files. * CVE-2025-23048 An access control bypass vulnerability was found in Apache httpd. The Apache HTTP Server with some mod_ssl configurations can bypass the access controls by trusted clients using TLS 1.3 session resumption. A client trusted to access one virtual host may be able to access another if SSLStrictSNIVHostCheck is not enabled on either host. * CVE-2025-49812 An HTTP session hijacking flaw was found in Apache httpd. In some mod_ssl configurations on Apache HTTP Server, an HTTP desynchronization attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Moderate Copyright 2025 Softline PJSC CVE-2024-47252 CVE-2025-23048 CVE-2025-49812 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. * CVE-2025-8067 A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users. Important Copyright 2025 Softline PJSC CVE-2025-8067 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2025-8194 A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module. Moderate Copyright 2025 Softline PJSC CVE-2025-8194 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions. * CVE-2025-54389 A flaw was found in AIDE. This flaw allows an attacker to craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and tamper with the log output. A local user may exploit this to bypass AIDE's detection of malicious files. Additionally, the output of extended attribute key names and symbolic links targets is also not properly neutralized. Important Copyright 2025 Softline PJSC CVE-2025-54389 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-9179 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker is able to perform memory corruption in the GMP process which process encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. * CVE-2025-9180 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: Canvas2D component. * CVE-2025-9181 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the JavaScript Engine component. * CVE-2025-9182 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service due to out-of-memory in the Graphics: WebRender component. * CVE-2025-9185 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs are present in the following versions: Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code. Important Copyright 2025 Softline PJSC CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-9179 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker is able to perform memory corruption in the GMP process which process encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. * CVE-2025-9180 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: Canvas2D component. * CVE-2025-9181 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the JavaScript Engine component. * CVE-2025-9182 A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service due to out-of-memory in the Graphics: WebRender component. * CVE-2025-9185 A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs are present in the following versions: Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code. Important Copyright 2025 Softline PJSC CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. * CVE-2024-13176 A timing side-channel vulnerability was found in OpenSSL. This vulnerability allows an attacker to recover the private key. However, measuring the timing would require local access to the signing application or a fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This issue can happen with significant probability only for some of the supported elliptic curves. In particular, the NIST P-521 curve is affected. * CVE-2025-5399 Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS libcurl-using application. * CVE-2025-21574 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21575 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21577 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21579 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21580 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21581 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21584 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21585 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-21588 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30681 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. * CVE-2025-30682 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30683 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30684 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30685 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30687 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30688 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30689 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30693 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. * CVE-2025-30695 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. * CVE-2025-30696 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30699 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30703 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. * CVE-2025-30704 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30705 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30715 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30721 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-30722 Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Client accessible data as well as unauthorized update, insert or delete access to some of MySQL Client accessible data. * CVE-2025-50077 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50078 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50079 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50080 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50081 Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data as well as unauthorized read access to a subset of MySQL Client accessible data. * CVE-2025-50082 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50083 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50084 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50085 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. * CVE-2025-50086 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50087 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. * CVE-2025-50088 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50091 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50092 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50093 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50094 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.42, 8.4.5 and 9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50096 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50097 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50098 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. * CVE-2025-50099 Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50100 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. * CVE-2025-50101 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50102 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. * CVE-2025-50104 Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. Moderate Copyright 2025 Softline PJSC CVE-2024-13176 CVE-2025-21574 CVE-2025-21575 CVE-2025-21577 CVE-2025-21579 CVE-2025-21580 CVE-2025-21581 CVE-2025-21584 CVE-2025-21585 CVE-2025-21588 CVE-2025-30681 CVE-2025-30682 CVE-2025-30683 CVE-2025-30684 CVE-2025-30685 CVE-2025-30687 CVE-2025-30688 CVE-2025-30689 CVE-2025-30693 CVE-2025-30695 CVE-2025-30696 CVE-2025-30699 CVE-2025-30703 CVE-2025-30704 CVE-2025-30705 CVE-2025-30715 CVE-2025-30721 CVE-2025-30722 CVE-2025-50077 CVE-2025-50078 CVE-2025-50079 CVE-2025-50080 CVE-2025-50081 CVE-2025-50082 CVE-2025-50083 CVE-2025-50084 CVE-2025-50085 CVE-2025-50086 CVE-2025-50087 CVE-2025-50088 CVE-2025-50091 CVE-2025-50092 CVE-2025-50093 CVE-2025-50094 CVE-2025-50096 CVE-2025-50097 CVE-2025-50098 CVE-2025-50099 CVE-2025-50100 CVE-2025-50101 CVE-2025-50102 CVE-2025-50104 CVE-2025-5399 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. * CVE-2025-58060 A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize() function, the password is not checked. This vulnerability allows attackers to bypass authentication entirely, resulting in unauthorized access to administrative functions and system configuration. * CVE-2025-58364 OpenPrinting CUPS is vulnerable to a denial of service, caused by a NULL pointer dereferences flaw due to an unsafe deserialization and validation of printer attributes. Important Copyright 2025 Softline PJSC CVE-2025-58060 CVE-2025-58364 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-9566 There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Important Copyright 2025 Softline PJSC CVE-2025-9566 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-10527 firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component. * CVE-2025-10528 firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. * CVE-2025-10529 irefox: thunderbird: Same-origin policy bypass in the Layout component. * CVE-2025-10532 firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component. * CVE-2025-10533 firefox: thunderbird: Integer overflow in the SVG component. * CVE-2025-10536 firefox: thunderbird: Information disclosure in the Networking: Cache component. * CVE-2025-10537 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Important Copyright 2025 Softline PJSC CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: * CVE-2025-32988 A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior. * CVE-2025-32989 A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly. * CVE-2025-32990 A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system. * CVE-2025-6395 A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite(). Bug Fixes and Enhancements: * gnutls: Vulnerability in GnuTLS certtool template parsing. * gnutls: Vulnerability in GnuTLS SCT extension parsing. * gnutls: Vulnerability in GnuTLS otherName SAN export. * gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite(). Moderate Copyright 2025 Softline PJSC CVE-2025-32988 CVE-2025-32989 CVE-2025-32990 CVE-2025-6395 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Various system configurations for MSVSphere Bug Fix(es) and Enhancement(s): * Fixing the inability to update via gnome-software Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. * CVE-2024-45776 When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections. * CVE-2024-45781 A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections. * CVE-2025-0622 A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections. * CVE-2025-0677 A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the file content, however, it fails to check if the symlink data size has overflown. When this occurs, grub_malloc() may be called with a smaller value than needed. When further reading the data from the disk into the buffer, the grub_ufs_lookup_symlink() function will write past the end of the allocated size. An attack can leverage this by crafting a malicious filesystem, and as a result, it will corrupt data stored in the heap, allowing for arbitrary code execution used to by-pass secure boot mechanisms. * CVE-2025-1118 A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. Moderate Copyright 2025 Softline PJSC CVE-2024-45776 CVE-2024-45781 CVE-2025-0622 CVE-2025-0677 CVE-2025-1118 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-10527 firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component. * CVE-2025-10528 firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. * CVE-2025-10529 irefox: thunderbird: Same-origin policy bypass in the Layout component. * CVE-2025-10532 firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component. * CVE-2025-10533 firefox: thunderbird: Integer overflow in the SVG component. * CVE-2025-10536 firefox: thunderbird: Information disclosure in the Networking: Cache component. * CVE-2025-10537 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Important Copyright 2025 Softline PJSC CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. * CVE-2024-52615 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Moderate Copyright 2025 Softline PJSC CVE-2024-52615 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Collector with the supported components for a Red Hat build of OpenTelemetry * CVE-2025-4673 A flaw was found in net/http. Handling Proxy-Authorization and Proxy-Authenticate headers during cross-origin redirects allows these headers to be inadvertently forwarded, potentially exposing sensitive authentication credentials. This flaw allows a network-based attacker to manipulate redirect responses, unintentionally exposing authentication details to unauthorized parties. Moderate Copyright 2025 Softline PJSC CVE-2025-4673 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines. * CVE-2025-49133 A flaw was found in libtpms. A heap buffer overflow can occur in the tpms_parse_pssh function when parsing a malformed Public Signature Key Exchange (PSK) structure. A local attacker can trigger this overflow by providing a crafted PSK structure to the library. This can lead to a denial of service or allow for arbitrary code execution. Moderate Copyright 2025 Softline PJSC CVE-2025-49133 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The command-line-assistant package provides a simple wrapper to interact with RAG. * CVE-2025-5962 A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering. Moderate Copyright 2025 Softline PJSC CVE-2025-5962 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. * CVE-2025-40928 A flaw was found in the JSON-XS Perl module. A buffer overflow can be triggered due to an integer overflow when a specially crafted JSON input is processed, causing a segmentation fault, crashing the application using the module and resulting in a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2025-40928 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. * CVE-2025-7493 A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration. Important Copyright 2025 Softline PJSC CVE-2025-7493 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. * CVE-2025-41244 A flaw was found in VMWare open-vm-tools. A malicious actor with non-administrative privileges on a guest Virtual Machine (VM) could exploit this vulnerability to gain root privileges on the VM. The issue lies in the service-discovery plugin logic, which can execute attacker-controlled binaries from writable paths such as /tmp. Exploitation requires the open-vm-tools-sdmp package to be installed and guest service discovery to be enabled. Important Copyright 2025 Softline PJSC CVE-2025-41244 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Chromium is an open-source web browser, powered by WebKit (Blink) * CVE-2025-10890 Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) * CVE-2025-10891 Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) * CVE-2025-10892 Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important Copyright 2025 Softline PJSC cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-21991 In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes. * CVE-2025-21759 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send(). * CVE-2025-37799 In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp. Important Copyright 2025 Softline PJSC CVE-2025-21759 CVE-2025-21991 CVE-2025-37799 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38718 A flaw in the SCTP receive path failed to linearize cloned GSO sk_buffs before accessing fraglists, leading to reads of uninitialized memory as reported by KMSAN. An attacker sending SCTP traffic can trigger incorrect processing and potentially cause a kernel denial of service on the target under specific RX conditions. Stream Control Transmission Protocol (SCTP) is a transport-layer protocol (like TCP or UDP) primarily used in telecom signaling and some specialized applications. On most Linux systems it is disabled by default, and remote connectivity is only possible if SCTP support is enabled and listening services are configured (commonly using the IANA-assigned port 2905/tcp for M3UA or other protocol-specific ports). Therefore, the vulnerability is only exploitable when SCTP is enabled and reachable on the target system. Although KMSAN reports this issue as use of uninitialized memory (which deterministically crashes with KMSAN enabled), on production kernels the impact is still availability-related. * CVE-2025-22026 In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register(). Moderate Copyright 2025 Softline PJSC CVE-2025-22026 CVE-2025-38718 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-22036 In the Linux kernel, the following vulnerability has been resolved: exfat: fix random stack corruption after get_block. Important Copyright 2025 Softline PJSC CVE-2025-22036 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2024-57980 In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path. * CVE-2024-58002 A dangling pointer vulnerability was found in the Linux kernel. When an async control is written, a copy of a pointer is made in the file handle that started the operation. If the user closes that file descriptor, its structure will be freed and there will be one dangling pointer per pending async control that the driver will try to use, leading to denial of service of the system. * CVE-2025-38089 A flaw was found in the Linux kernel, where a specially crafted RPC packet could cause data corruption or trigger a system panic. This flaw allows a remote attacker who can make RPC calls to send an intentionally malformed packet, potentially compromising system integrity or causing a denial of service (DoS). * CVE-2025-21905 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file. * CVE-2025-37958 In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry. Important Copyright 2025 Softline PJSC CVE-2024-57980 CVE-2024-58002 CVE-2025-21905 CVE-2025-37958 CVE-2025-38089 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-37914 A use-after-free vulnerability was found in the Linux kernel’s netem qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system instability, or a crash. * CVE-2025-38200 In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw. * CVE-2025-38417 In the Linux kernel, the following vulnerability has been resolved: ice: fix eswitch code memory leak in reset scenario. Important Copyright 2025 Softline PJSC CVE-2025-37914 CVE-2025-38200 CVE-2025-38417 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38079 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept. * CVE-2025-38292 In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory. * CVE-2025-38085 In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race. * CVE-2025-38159 In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds. * CVE-2025-38084 In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before. * CVE-2024-56721 A flaw was found in the AMD CPU erratum handling code in the Linux kernel. The erratum_1386_microcode array lacked a proper terminator, which could cause the x86_match_cpu_with_stepping() function to read beyond the end of the array. This results in undefined behavior during CPU feature detection and erratum handling. A local attacker may be able to exploit this flaw to cause a system crash or instability, affecting system availability. * CVE-2025-38137 Fixes a use-after-free vulnerability in the PCI/pwrctrl subsystem. If rescan_work_func() is still executing when the pwrctrl structure is freed (e.g., upon driver removal), the system may crash or exhibit undefined behavior. The vulnerability can potentially be triggered by a local attacker with limited privileges by forcing long-running rescan work and unloading the related driver concurrently. This bug not introduced yet in any version of the Red Hat Enterprise Linux, so not affected for all versions (apart from latest Red Hat Enterprise Linux 10 where going to check this additionally). Moderate Copyright 2025 Softline PJSC CVE-2024-56721 CVE-2025-38079 CVE-2025-38084 CVE-2025-38085 CVE-2025-38137 CVE-2025-38159 CVE-2025-38292 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-22091 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix page_size variable overflow. * CVE-2025-22121 In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all(). * CVE-2025-37797 In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling. * CVE-2025-38110 In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access. * CVE-2025-38088 A denial-of-service vulnerability has been identified in the Linux kernel, stemming from an out-of-bounds overflow. This flaw occurs when the requested memory mapping region size exceeds the allocated region size. An attacker can exploit this by crafting a specially designed file, which, when processed by the kernel, could trigger an overflow. This leads to a system crash, impacting the availability of the affected system. Moderate Copyright 2025 Softline PJSC CVE-2025-22091 CVE-2025-22121 CVE-2025-37797 CVE-2025-38088 CVE-2025-38110 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38086 In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart. * CVE-2025-22085 In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name. * CVE-2025-22113 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying. * CVE-2025-21727 In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder. * CVE-2025-21928 In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove(). * CVE-2025-21929 In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove(). * CVE-2025-22020 In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove. * CVE-2025-37890 A use-after-free vulnerability has been identified in the Linux kernel's HFSC (Hierarchical Fair Service Curve) queuing discipline when it is configured with NETEM (Network Emulation) as a child. This flaw can lead to a kernel panic or crash due to incorrect assumptions about the queue state. Exploitation of this vulnerability requires local access with CAP_NET_ADMIN privileges and control over the qdisc (queueing discipline) setup. A local attacker could leverage this flaw to achieve denial of service or escalate privileges. Given that it affects kernel memory structures, successful exploitation could result in memory corruption, data leaks, or arbitrary write capabilities, leading to a full kernel crash. * CVE-2025-38052 In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free. * CVE-2025-38087 In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier. * CVE-2025-38264 The vulnerability lies in the lack of validation for list membership in nvme_tcp_handle_r2t(), potentially allowing malicious R2T PDUs to introduce list corruption or loops. This could lead to denial of service or memory corruption. Important Copyright 2025 Softline PJSC CVE-2025-21727 CVE-2025-21928 CVE-2025-21929 CVE-2025-22020 CVE-2025-22085 CVE-2025-22113 CVE-2025-37890 CVE-2025-38052 CVE-2025-38086 CVE-2025-38087 CVE-2025-38264 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-21867 In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type(). * CVE-2025-38124 A denial of service vulnerability has been discovered in the Linux kernel's UDP Generic Segmentation Offload (GSO) functionality. This flaw allows a local, unprivileged user to trigger a kernel crash by generating UDP packets with a specially malformed frag_list geometry. Successful exploitation of this vulnerability could lead to a system crash, severely impacting the availability and stability of the affected system. * CVE-2025-38250 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush(). * CVE-2025-38380 In the Linux kernel, the following vulnerability has been resolved: i2c/designware: Fix an initialization issue. * CVE-2025-38471 In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock. Important Copyright 2025 Softline PJSC CVE-2025-21867 CVE-2025-38124 CVE-2025-38250 CVE-2025-38380 CVE-2025-38471 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38500 In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md. * CVE-2025-38550 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: аn IPv6 MLD bookkeeping bug freed pmc->idev before it was used in ip6_mc_clear_src(), causing a use-after-free in the multicast code path. A remote attacker on the same L2 segment could potentially trigger a kernel crash via crafted MLD activity, leading to DoS. * CVE-2025-38392 In the Linux kernel, the following vulnerability has been resolved: idpf: convert control queue mutex to a spinlock. * CVE-2025-38332 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version. * CVE-2025-38498 In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts. * CVE-2025-22068 In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen. * CVE-2025-38463 In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation. * CVE-2025-39770 In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM. Moderate Copyright 2025 Softline PJSC CVE-2025-22068 CVE-2025-38332 CVE-2025-38392 CVE-2025-38463 CVE-2025-38498 CVE-2025-38500 CVE-2025-38550 CVE-2025-39770 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38350 A use-after-free (UAF) vulnerability was found in the Linux kernel's net/sched subsystem, specifically in the Credit-Based Shaper (CBS) qdisc implementation (sch_cbs). The vulnerability occurs because the CBS qdisc's reset function (qdisc_reset_queue()) only resets its internal queue but fails to reset its child qdisc recursively. As a result, a mismatch in queue length (qlen) occurs between CBS and its children during interface resets, eventually allowing attackers to trigger UAF on a parent HFSC scheduler. * CVE-2025-37803 In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation. * CVE-2025-22097 In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error. If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it. * CVE-2025-38449 In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers. * CVE-2025-38684 In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes. Important Copyright 2025 Softline PJSC CVE-2025-22097 CVE-2025-37803 CVE-2025-38350 CVE-2025-38449 CVE-2025-38684 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-37810 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length. * CVE-2025-38566 A remotely reachable flaw in the SUNRPC NFS-over-TLS server could allow a client to trigger a kernel crash by sending a crafted TLS alert. The issue lies in how the kernel processes TLS control messages, which can lead to use-after-free or invalid memory accesses during alert handling. Moderate Copyright 2025 Softline PJSC CVE-2025-37810 CVE-2025-38566 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38352 A race condition was found in the Linux kernel’s POSIX CPU timer handling, where handle_posix_cpu_timers() may run concurrently with posix_cpu_timer_del() on an exiting task which could result in use-after-free scenarios. An attacker with local user access could use this flaw to crash or escalate their privileges on a system. Important Copyright 2025 Softline PJSC CVE-2025-38352 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-22058 A memory overflow vulnerability exists within the Linux kernel's networking subsystem. Specifically, an application can set the SO_RCVBUF socket option to its maximum value (INT_MAX), which triggers an integer overflow within the udp_rmem_release() function during socket closure. The udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable. The total size is then passed to udp_rmem_release() to adjust memory accounting. Due to the function taking a signed integer argument, the total size can wrap around, causing a memory overflow condition, potentially leading to system instability. * CVE-2025-37823 In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too. * CVE-2025-38211 In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction. * CVE-2025-38461 In the Linux kernel, the following vulnerability has been resolved: vsock: Transport assignment may race with module unload. * CVE-2025-38464 In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). * CVE-2025-38472 The vulnerability in nf_conntrack can be triggered by an unprivileged user under typical configurations where user and network namespaces are available (e.g., via unshare or CLONE_NEWNET). This enables the user to initiate Netfilter-based networking operations (such as NAT or connection tracking) even if the system had no prior active conntrack entries. Since exploitation does not require elevated privileges beyond what is granted in the default namespace setup with CAP_NET_RAW or similar, the Privileges Required (PR) is assessed as Low. The primary attack vector is remote-triggered packets from user-controlled namespaces that cause conntrack allocation and destruction races, leading to a potential kernel panic. * CVE-2025-38220 In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files. Moderate Copyright 2025 Softline PJSC CVE-2025-22058 CVE-2025-37823 CVE-2025-38211 CVE-2025-38220 CVE-2025-38461 CVE-2025-38464 CVE-2025-38472 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-39694 In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check. * CVE-2025-38527 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break. * CVE-2025-39682 A logic bug in the kTLS receive path mishandles zero-length records taken from the rx_list, allowing a mixed record-type sequence to slip past the per-recvmsg() type constraint and proceed to data processing. The fix initializes and checks the per-call content type (using 0 as “unset”) and bails out when a non-DATA record is encountered after DATA. This can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use. This issue can only be triggered when the kernel TLS ULP (kTLS, enabled via CONFIG_TLS and attached to TCP sockets with SOL_TLS) is in use. * CVE-2025-39698 A flaw in io_uring’s futex path freed io_futex_data on error but left req->async_data and the REQ_F_ASYNC_DATA flag inconsistent, creating a window for use-after-free. This issue is reachable by any unprivileged local user via io_uring futex operations. The most plausible impact is denial of service, since the freed structure is small and not directly attacker-controlled, making exploitation for privilege escalation very unlikely. Still, as with any use-after-free in kernel space, a worst-case impact would be privileges escalation. * CVE-2025-38396 In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass. * CVE-2025-38523 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy. Moderate Copyright 2025 Softline PJSC CVE-2025-38396 CVE-2025-38523 CVE-2025-38527 CVE-2025-39682 CVE-2025-39694 CVE-2025-39698 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38556 In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits. * CVE-2025-39761 n the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling. * CVE-2025-39757 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors. Moderate Copyright 2025 Softline PJSC CVE-2025-38556 CVE-2025-39757 CVE-2025-39761 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21. * CVE-2025-55247 A flaw was found in MSBuild’s temporary directory handling on Linux where predictable, non-randomized temporary paths are used. Local users can create or manipulate those paths before MSBuild runs, causing build failures or unexpected behavior and resulting in denial of service for build operations. * CVE-2025-55248 A flaw exists in certain .NET builds where a man-in-the-middle (MITM) attacker can prevent or downgrade TLS between a client and an SMTP server. This may cause the client to send credentials or message data over an unencrypted connection, exposing sensitive information to the attacker. * CVE-2025-55315 A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended forwarding of request data. Important Copyright 2025 Softline PJSC CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-11708 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in MediaTrackGraphImpl::GetInstance(). By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11709 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read/write in a privileged process triggered by WebGL textures. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11710 Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the leaking of cross-process information due to malicious IPC messages. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to obtain sensitive information. * CVE-2025-11711 Mozilla Firefox could allow a remote attacker to bypass security restrictions. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to modify some non-writable Object properties. * CVE-2025-11712 A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. * CVE-2025-11714 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11715 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10. * CVE-2025-55247 A flaw was found in MSBuild’s temporary directory handling on Linux where predictable, non-randomized temporary paths are used. Local users can create or manipulate those paths before MSBuild runs, causing build failures or unexpected behavior and resulting in denial of service for build operations. * CVE-2025-55248 A flaw exists in certain .NET builds where a man-in-the-middle (MITM) attacker can prevent or downgrade TLS between a client and an SMTP server. This may cause the client to send credentials or message data over an unencrypted connection, exposing sensitive information to the attacker. * CVE-2025-55315 A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended forwarding of request data. Important Copyright 2025 Softline PJSC CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. * CVE-2025-11021 A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup. Important Copyright 2025 Softline PJSC CVE-2025-11021 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. * CVE-2025-5318 A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior. Moderate Copyright 2025 Softline PJSC CVE-2025-5318 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-11708 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in MediaTrackGraphImpl::GetInstance(). By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11709 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds read/write in a privileged process triggered by WebGL textures. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11710 Mozilla Firefox could allow a remote attacker to obtain sensitive information, caused by the leaking of cross-process information due to malicious IPC messages. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to obtain sensitive information. * CVE-2025-11711 Mozilla Firefox could allow a remote attacker to bypass security restrictions. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to modify some non-writable Object properties. * CVE-2025-11712 A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. * CVE-2025-11714 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-11715 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by memory safety bugs within the browser engine. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38351 In the Linux kernel, the following vulnerability has been resolved: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush. * CVE-2025-38614 A local unprivileged user can trigger this issue by creating deeply nested chains of epoll file descriptors using the standard epoll_create and epoll_ctl syscalls. No special capabilities or elevated rights are required — any user with the ability to open file descriptors can exploit it. This can lead to excessive kernel stack usage and ultimately a denial of service (system crash). * CVE-2025-38571 In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts. * CVE-2025-39817 In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare. * CVE-2025-39841 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path. * CVE-2025-38572 In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment(). Moderate Copyright 2025 Softline PJSC CVE-2025-38351 CVE-2025-38571 CVE-2025-38572 CVE-2025-38614 CVE-2025-39817 CVE-2025-39841 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The LibTIFF packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. * CVE-2025-9900 A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user. Important Copyright 2025 Softline PJSC CVE-2025-9900 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-39730 A flaw out of boundary read in the Linux kernel NFS functionality was found in the way connected user sends malicious data to the server. A remote user could use this flaw to crash the system. * CVE-2025-39849 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result(). * CVE-2025-39751 In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control. * CVE-2025-39718 In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put(). * CVE-2025-39697 In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write. * CVE-2025-39727 Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a buffer overflow in the setup_clusters() function. Moderate Copyright 2025 Softline PJSC CVE-2025-39697 CVE-2025-39718 CVE-2025-39727 CVE-2025-39730 CVE-2025-39751 CVE-2025-39849 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Expat is a C library for parsing XML documents. * CVE-2025-59375 A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion. Important Copyright 2025 Softline PJSC CVE-2025-59375 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. * CVE-2025-46817 Redis could allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution. * CVE-2025-46818 Redis could allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. * CVE-2025-46819 Redis could allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. * CVE-2025-49844 Redis could allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. Important Copyright 2025 Softline PJSC CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. * CVE-2025-27144 A flaw was found in GO-JOSE. In affected versions, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of . characters. This issue could be exploied by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Moderate Copyright 2025 Softline PJSC CVE-2025-27144 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. * CVE-2025-4945 A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines. Low Copyright 2025 Softline PJSC CVE-2025-4945 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Vim (Vi IMproved) is an updated and improved version of the vi editor. * CVE-2025-53905 A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. * CVE-2025-53906 A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Moderate Copyright 2025 Softline PJSC CVE-2025-53905 CVE-2025-53906 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-39702 Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by timing attack in MAC comparison. * CVE-2025-39881 In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released. Moderate Copyright 2025 Softline PJSC CVE-2025-39702 CVE-2025-39881 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Xwayland is an X server for running X clients under Wayland. * CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service. * CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect. * CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Moderate Copyright 2025 Softline PJSC CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. * CVE-2025-59830 An unsafe default behavior in Rack::QueryParser allows bypass of the params_limit parameter count restriction when query string parameters are delimited by semicolons (;) rather than ampersands (&). The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, an attacker can supply a crafted HTTP query using ; delimiters to exceed the intended parameter count, potentially causing performance degradation or exhaustion of resources (denial of service). * CVE-2025-61770 Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. * CVE-2025-61771 Rack::Multipart::Parser stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. * CVE-2025-61772 Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. * CVE-2025-61919 A memory-exhaustion vulnerability exists in Rack when parsing application/x-www-form-urlencoded request bodies. Rack::Request#POST reads the entire request body into memory without enforcing a maximum length or cap. Attackers can exploit this by sending large form submissions, potentially causing denial of service (DoS) through memory exhaustion. Even with configured parsing limits, the issue occurs before those limits are enforced, allowing unbounded memory allocation proportional to request size. Important Copyright 2025 Softline PJSC CVE-2025-59830 CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVE-2025-61919 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. * CVE-2025-10729 The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free. Important Copyright 2025 Softline PJSC CVE-2025-10729 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. * CVE-2025-11561 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts. Important Copyright 2025 Softline PJSC CVE-2025-11561 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. * CVE-2025-40778 A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records (RRs) in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache, redirecting clients to malicious domains or unauthorized servers. * CVE-2025-40780 ISC BIND could allow a remote attacker to poison the DNS cache, caused by a weakness in the Pseudo Random Number Generator (PRNG). An attacker could exploit this vulnerability to predict the source port and query ID that BIND will use. * CVE-2025-8677 ISC BIND is vulnerable to a denial of service, caused by improper DNSKEY handling. By querying for records within a specially crafted zone containing certain malformed DNSKEY records, a remote attacker could exploit this vulnerability to exhaust CPU resources. Important Copyright 2025 Softline PJSC CVE-2025-40778 CVE-2025-40780 CVE-2025-8677 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. * CVE-2025-11230 A flaw was found in haproxy. A stemming from an inefficient algorithmic complexity issue within its bundled mjson parsing library. This vulnerability is triggered when haproxy is configured to analyze JSON content, such as with the json_query or jwt_payload_query function Important Copyright 2025 Softline PJSC CVE-2025-11230 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Go is a high-level general purpose programming language that is statically typed and compiled. It is known for the simplicity of its syntax and the efficiency of development that it enables by the inclusion of a large standard library supplying many needs for common projects. It was designed at Google. * CVE-2025-58183 A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service. Moderate Copyright 2025 Softline PJSC CVE-2025-58183 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Qt 6 Quick3D library. * CVE-2025-11277 Open Asset Import Library (assimp) is vulnerable to a denial of service, caused by a heap-based buffer-overflow in Q3DImporter::InternReadFile. Moderate Copyright 2025 Softline PJSC CVE-2025-11277 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. * CVE-2025-62168 A Information Disclosure vulnerability has been identified in the Squid web caching proxy. This flaw occurs when the application fails to properly redact sensitive Hypertext Transfer Protocol (HTTP) authentication credentials from an error response. A remote client can exploit this by triggering an error condition, which allows a malicious script to bypass browser security and disclose the username and password a trusted client uses for access. This directly compromises the security of internal application credentials and security tokens, especially when Squid is configured for backend load balancing. Important Copyright 2025 Softline PJSC CVE-2025-62168 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. * CVE-2025-5318 A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior. Moderate Copyright 2025 Softline PJSC CVE-2025-5318 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. * CVE-2025-11561 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts. Important Copyright 2025 Softline PJSC CVE-2025-11561 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. * CVE-2025-7493 A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration. Important Copyright 2025 Softline PJSC CVE-2025-7493 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. * CVE-2025-40779 A vulnerability was found in Kea. When an attacker who is an existing client with an assigned IP sends a crafted unicast packet directly to the server's IP and Kea cannot find any subnets that match that client's credentials, the server crashes causing a Denial of Service via assertion/NULL-path failure. This vulnerability does not persist for broadcast packets because they ignore such unverifiable clients. Important Copyright 2025 Softline PJSC CVE-2025-40779 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2024-28956 New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHI_NO, by leveraging in-kernel gadgets (potentially accessible via SECCOMP/cBPF), Branch Target Buffer (BTB) aliasing, and direct-to-indirect branch predictor training. While the root cause lies in CPU architectural behavior, the vulnerability manifests through kernel-level speculation paths, allowing attackers to potentially leak sensitive memory. * CVE-2025-39864 A use-after-free issue was discovered in the cfg80211 subsystem, caused by freeing beacon_ies structures even when they were still referenced through hidden_beacon_bss. Moderate Copyright 2025 Softline PJSC CVE-2024-28956 CVE-2025-39864 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. * CVE-2025-6020 A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions. Important Copyright 2025 Softline PJSC CVE-2025-6020 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. * CVE-2024-56433 A flaw was found in shadow-utils. Affected versions of shadow-utils establish a default /etc/subuid behavior, for example, uid 100000 through 165535 for the first user account, that can conflict with the uids of users defined on locally administered networks. This issue potentially leads to account takeover by leveraging newuidmap for access to an NFS home directory or same-host resources for remote logins by these local network users. Low Copyright 2025 Softline PJSC CVE-2024-56433 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. * CVE-2025-5244 A vulnerability was found in GNU Binutils 2.40 to version 2.44 and affects the elf_gc_sweep function of the bfd/elflink.c file of the component ld. The manipulation leads to memory corruption and a program crash. An attacker must have local access to exploit this vulnerability. Moderate Copyright 2025 Softline PJSC CVE-2025-5244 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. * CVE-2025-32728 A flaw was found in OpenSSH. In affected versions of sshd, the DisableForwarding directive does not fully adhere to the intended functionality as documented. Specifically, it fails to disable X11 and agent forwarding, which may allow unintended access under certain configurations. Moderate Copyright 2025 Softline PJSC CVE-2025-32728 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The zziplib is a lightweight library to easily extract data from zip files. * CVE-2018-17828 It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing files, or creating new ones. Moderate Copyright 2025 Softline PJSC CVE-2018-17828 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-52881 A flaw was found in runc. This is a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. Important Copyright 2025 Softline PJSC CVE-2025-52881 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Vim (Vi IMproved) is an updated and improved version of the vi editor. * CVE-2025-53905 A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. * CVE-2025-53906 A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. Moderate Copyright 2025 Softline PJSC CVE-2025-53905 CVE-2025-53906 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The LibTIFF packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. * CVE-2025-9900 A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user. Important Copyright 2025 Softline PJSC CVE-2025-9900 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. * CVE-2025-9566 There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. * CVE-2025-47907 A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application. Important Copyright 2025 Softline PJSC CVE-2025-47907 CVE-2025-9566 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. * CVE-2025-10728 When the module renders an Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS. Moderate Copyright 2025 Softline PJSC CVE-2025-10728 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Expat is a C library for parsing XML documents. * CVE-2025-59375 A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion. Important Copyright 2025 Softline PJSC CVE-2025-59375 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-38614 A local unprivileged user can trigger this issue by creating deeply nested chains of epoll file descriptors using the standard epoll_create and epoll_ctl syscalls. No special capabilities or elevated rights are required — any user with the ability to open file descriptors can exploit it. This can lead to excessive kernel stack usage and ultimately a denial of service (system crash). * CVE-2025-39864 A use-after-free issue was discovered in the cfg80211 subsystem, caused by freeing beacon_ies structures even when they were still referenced through hidden_beacon_bss. * CVE-2025-39903 In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing kernel panic. * CVE-2025-39946 In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus. Moderate Copyright 2025 Softline PJSC CVE-2025-38614 CVE-2025-39864 CVE-2025-39903 CVE-2025-39946 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. * CVE-2025-53057 An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE related to the Security component could allow a remote attacker to cause no confidentiality impact, high integrity impact, and no availability impact. * CVE-2025-53066 An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE related to the JAXP component could allow a remote attacker to cause high confidentiality impact, no integrity impact, and no availability impact. * CVE-2025-61748 An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE related to the Libraries component could allow a remote attacker to cause high confidentiality impact, no integrity impact, and no availability impact. Moderate Copyright 2025 Softline PJSC CVE-2025-53057 CVE-2025-53066 CVE-2025-61748 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-39730 A flaw out of boundary read in the Linux kernel NFS functionality was found in the way connected user sends malicious data to the server. A remote user could use this flaw to crash the system. * CVE-2025-39955 tcp_disconnect() failed to clear tcp_sk(sk)->fastopen_rsk when reusing a TFO socket (e.g., after accept() → connect(AF_UNSPEC) → connect() sequence). This left a stale reference, allowing the retransmit timer to access a freed request_sock, triggering a kernel warning or potential UAF. Moderate Copyright 2025 Softline PJSC CVE-2025-39730 CVE-2025-39955 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. * CVE-2025-40778 A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records (RRs) in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache, redirecting clients to malicious domains or unauthorized servers. * CVE-2025-40780 ISC BIND could allow a remote attacker to poison the DNS cache, caused by a weakness in the Pseudo Random Number Generator (PRNG). An attacker could exploit this vulnerability to predict the source port and query ID that BIND will use. * CVE-2025-8677 ISC BIND is vulnerable to a denial of service, caused by improper DNSKEY handling. By querying for records within a specially crafted zone containing certain malformed DNSKEY records, a remote attacker could exploit this vulnerability to exhaust CPU resources. Important Copyright 2025 Softline PJSC CVE-2025-40778 CVE-2025-40780 CVE-2025-8677 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. * CVE-2025-62168 A Information Disclosure vulnerability has been identified in the Squid web caching proxy. This flaw occurs when the application fails to properly redact sensitive Hypertext Transfer Protocol (HTTP) authentication credentials from an error response. A remote client can exploit this by triggering an error condition, which allows a malicious script to bypass browser security and disclose the username and password a trusted client uses for access. This directly compromises the security of internal application credentials and security tokens, especially when Squid is configured for backend load balancing. Important Copyright 2025 Softline PJSC CVE-2025-62168 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. * CVE-2025-11232 A flaw was found in Kea. A remote attacker can send specific option content to the kea-dhcp4 server. When the server is configured with specific parameters, an assertion failure can be triggered and cause the kea-dhcp4 process to exit unexpectedly, resulting in a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-11232 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-13012 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a race condition in the Graphics component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13013 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Core & HTML component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13014 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13015 Mozilla Firefox could allow a remote attacker to conduct spoofing attacks. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to conduct a spoofing attack. * CVE-2025-13016 Mozilla Firefox is vulnerable to a buffer overflow, caused by an incorrect boundary conditions in the JavaScript: WebAssembly component. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. * CVE-2025-13017 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Notifications component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13018 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Security component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13019 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Workers component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13020 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the WebRTC: Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. * CVE-2025-59088 If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected. * CVE-2025-59089 If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients. Important Copyright 2025 Softline PJSC CVE-2025-59088 CVE-2025-59089 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. * CVE-2025-13012 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a race condition in the Graphics component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13013 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Core & HTML component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13014 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13015 Mozilla Firefox could allow a remote attacker to conduct spoofing attacks. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to conduct a spoofing attack. * CVE-2025-13016 Mozilla Firefox is vulnerable to a buffer overflow, caused by an incorrect boundary conditions in the JavaScript: WebAssembly component. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. * CVE-2025-13017 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Notifications component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13018 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Security component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13019 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Workers component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13020 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the WebRTC: Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Xwayland is an X server for running X clients under Wayland. * CVE-2025-62229 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service. * CVE-2025-62230 A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect. * CVE-2025-62231 A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Moderate Copyright 2025 Softline PJSC CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. * CVE-2025-9230 OpenSSL could allow a remote attacker to execute arbitrary code or trigger a crash on the system, caused by an out-of-bounds read and write flaw when trying to decrypt CMS messages encrypted using password based encryption. Moderate Copyright 2025 Softline PJSC CVE-2025-9230 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. * CVE-2025-11021 A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup. * CVE-2025-4945 A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines. Important Copyright 2025 Softline PJSC CVE-2025-11021 CVE-2025-4945 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. * CVE-2025-59830 An unsafe default behavior in Rack::QueryParser allows bypass of the params_limit parameter count restriction when query string parameters are delimited by semicolons (;) rather than ampersands (&). The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, an attacker can supply a crafted HTTP query using ; delimiters to exceed the intended parameter count, potentially causing performance degradation or exhaustion of resources (denial of service). * CVE-2025-61770 Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. * CVE-2025-61771 Rack::Multipart::Parser stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. * CVE-2025-61772 Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. * CVE-2025-61919 A memory-exhaustion vulnerability exists in Rack when parsing application/x-www-form-urlencoded request bodies. Rack::Request#POST reads the entire request body into memory without enforcing a maximum length or cap. Attackers can exploit this by sending large form submissions, potentially causing denial of service (DoS) through memory exhaustion. Even with configured parsing limits, the issue occurs before those limits are enforced, allowing unbounded memory allocation proportional to request size. Important Copyright 2025 Softline PJSC CVE-2025-59830 CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVE-2025-61919 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. * CVE-2025-10729 The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free. Important Copyright 2025 Softline PJSC CVE-2025-10729 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. * CVE-2025-52881 A flaw was found in runc. This is a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. * CVE-2025-58183 A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go program to try to allocate a large amount of memory, causing an out-of-memory condition and resulting in a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-52881 CVE-2025-58183 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 The kernel packages contain the Linux kernel, the core of any Linux operating system. * CVE-2025-22068 In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen. * CVE-2025-39971 In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg. * CVE-2025-38724 A vulnerability has been identified in the Linux kernel's Network File System (NFS) daemon that could allow for a Denial of Service and in worst case scenario Arbitrary Code Execution. This Use-After-Free flaw arises from a race condition when the kernel handles the confirmation of an NFS client identifier. If an NFS client is expiring while this confirmation is in progress, the system can attempt to use memory that is no longer allocated. * CVE-2025-39898 n the Linux kernel, the following vulnerability has been resolved: e1000e: fix heap overflow in e1000_set_eeprom. * CVE-2025-39918 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix linked list corruption. * CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory. Moderate Copyright 2025 Softline PJSC CVE-2025-22068 CVE-2025-38724 CVE-2025-39883 CVE-2025-39898 CVE-2025-39918 CVE-2025-39971 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Mozilla Thunderbird is a standalone mail and newsgroup client. * CVE-2025-13012 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a race condition in the Graphics component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13013 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Core & HTML component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13014 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. * CVE-2025-13015 Mozilla Firefox could allow a remote attacker to conduct spoofing attacks. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to conduct a spoofing attack. * CVE-2025-13016 Mozilla Firefox is vulnerable to a buffer overflow, caused by an incorrect boundary conditions in the JavaScript: WebAssembly component. By persuading a victim to visit a specially crafted Web site, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. * CVE-2025-13017 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Notifications component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13018 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a mitigation bypass in the DOM: Security component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13019 Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by a same-origin policy bypass in the DOM: Workers component. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to bypass security restrictions. * CVE-2025-13020 Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free in the WebRTC: Audio/Video component. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service. Important Copyright 2025 Softline PJSC CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. * CVE-2025-46817 Redis could allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution. * CVE-2025-46818 Redis could allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. * CVE-2025-46819 Redis could allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. * CVE-2025-49844 Redis could allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. Important Copyright 2025 Softline PJSC CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 cpe:/o:ncsd:msvsphere:10 MSVSphere OS 10 .NET 10 is a long-term support (LTS) release focused on performance and security enhancements, with new features in runtime, libraries, and the SDK. It includes performance improvements like faster JIT compilation and better loop optimizations, enhanced security with expanded cryptography support, and developer productivity features like updated libraries and consistent CLI commands. Security Update: * CVE-2025-55315 A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended forwarding of request data. Bug Fixes and Enhancements: * Update .NET 10 to RC 1 [rhel-10.1.z] * Update .NET 10 to RC 2 [rhel-10.1.z] * dotnet10.0: .NET Denial of Service Vulnerability [rhel-10.1.z] * dotnet10.0: .NET Security Feature Bypass Vulnerability [rhel-10.1.z] Important Copyright 2025 Softline PJSC CVE-2025-55315 cpe:/o:ncsd:msvsphere:10 ^sphere-release ^10\. /etc/sphere-release perl-FCGI tomcat tomcat-admin-webapps tomcat-docs-webapp tomcat-el-5.0-api tomcat-jsp-3.1-api tomcat-lib tomcat-servlet-6.0-api tomcat-webapps mod_auth_openidc ipp-usb apache-commons-beanutils apache-commons-beanutils-javadoc podman podman-docker podman-remote podman-tests git git-all git-core git-core-doc git-credential-libsecret git-daemon git-email git-gui git-instaweb git-subtree git-svn gitk gitweb perl-Git perl-Git-SVN libblockdev libblockdev-crypto libblockdev-dm libblockdev-fs libblockdev-loop libblockdev-lvm libblockdev-lvm-dbus libblockdev-mdraid libblockdev-mpath libblockdev-nvdimm libblockdev-nvme libblockdev-part libblockdev-plugins-all libblockdev-smart libblockdev-smartmontools libblockdev-swap libblockdev-tools libblockdev-utils python3-blockdev corosync corosync-vqsim corosynclib corosynclib-devel thunderbird php php-bcmath php-cli php-common php-dba php-dbg php-devel php-embedded php-enchant php-ffi php-fpm php-gd php-gmp php-intl php-ldap php-mbstring php-mysqlnd php-odbc php-opcache php-pdo php-pgsql php-process php-snmp php-soap php-xml opentelemetry-collector bsdtar libarchive libarchive-devel krb5-devel krb5-libs krb5-pkinit krb5-server krb5-server-ldap krb5-workstation libkadm5 firefox skopeo skopeo-tests qt6-qtbase qt6-qtbase-common qt6-qtbase-devel qt6-qtbase-examples qt6-qtbase-gui qt6-qtbase-mysql qt6-qtbase-odbc qt6-qtbase-postgresql qt6-qtbase-private-devel qt6-qtbase-static buildah buildah-tests expat expat-devel exiv2 exiv2-devel exiv2-doc exiv2-libs xz xz-devel xz-libs xz-lzma-compat ghostscript ghostscript-doc ghostscript-tools-dvipdf ghostscript-tools-fonts ghostscript-tools-printing libgs libgs-devel go-toolset golang golang-bin golang-docs golang-misc golang-src golang-tests varnish varnish-devel varnish-docs osbuild-composer osbuild-composer-core osbuild-composer-worker git-lfs grafana-pcp libvpx libvpx-devel libxslt libxslt-devel python3-jinja2 python3-jinja2+i18n perl perl-Attribute-Handlers perl-AutoLoader perl-AutoSplit perl-B perl-Benchmark perl-Class-Struct perl-Config-Extensions perl-DBM_Filter perl-Devel-Peek perl-Devel-SelfStubber perl-DirHandle perl-Dumpvalue perl-DynaLoader perl-English perl-Errno perl-ExtUtils-Constant perl-ExtUtils-Embed perl-ExtUtils-Miniperl perl-Fcntl perl-File-Basename perl-File-Compare perl-File-Copy perl-File-DosGlob perl-File-Find perl-File-stat perl-FileCache perl-FileHandle perl-FindBin perl-GDBM_File perl-Getopt-Std perl-Hash-Util perl-Hash-Util-FieldHash perl-I18N-Collate perl-I18N-LangTags perl-I18N-Langinfo perl-IO perl-IPC-Open3 perl-Locale-Maketext-Simple perl-Math-Complex perl-Memoize perl-Module-Loaded perl-NDBM_File perl-NEXT perl-Net perl-ODBM_File perl-Opcode perl-POSIX perl-Pod-Functions perl-Pod-Html perl-Safe perl-Search-Dict perl-SelectSaver perl-SelfLoader perl-Symbol perl-Sys-Hostname perl-Term-Complete perl-Term-ReadLine perl-Test perl-Text-Abbrev perl-Thread perl-Thread-Semaphore perl-Tie perl-Tie-File perl-Tie-Memoize perl-Time perl-Time-Piece perl-Unicode-UCD perl-User-pwent perl-autouse perl-base perl-blib perl-debugger perl-deprecate perl-devel perl-diagnostics perl-doc perl-encoding-warnings perl-fields perl-filetest perl-if perl-interpreter perl-less perl-lib perl-libnetcfg perl-libs perl-locale perl-macros perl-meta-notation perl-mro perl-open perl-overload perl-overloading perl-ph perl-sigtrap perl-sort perl-subs perl-utils perl-vars perl-vmsish ruby ruby-bundled-gems ruby-default-gems ruby-devel ruby-doc ruby-libs rubygem-bigdecimal rubygem-bundler rubygem-io-console rubygem-irb rubygem-json rubygem-minitest rubygem-power_assert rubygem-psych rubygem-racc rubygem-rake rubygem-rbs rubygem-rdoc rubygem-rexml rubygem-rss rubygem-test-unit rubygem-typeprof rubygems rubygems-devel gvisor-tap-vsock gvisor-tap-vsock-gvforwarder python3-tornado aspnetcore-runtime-8.0 aspnetcore-runtime-dbg-8.0 aspnetcore-targeting-pack-8.0 dotnet-apphost-pack-8.0 dotnet-hostfxr-8.0 dotnet-runtime-8.0 dotnet-runtime-dbg-8.0 dotnet-sdk-8.0 dotnet-sdk-8.0-source-built-artifacts dotnet-sdk-dbg-8.0 dotnet-targeting-pack-8.0 dotnet-templates-8.0 grafana grafana-selinux delve aspnetcore-runtime-9.0 aspnetcore-runtime-dbg-9.0 aspnetcore-targeting-pack-9.0 dotnet-apphost-pack-9.0 dotnet-host dotnet-hostfxr-9.0 dotnet-runtime-9.0 dotnet-runtime-dbg-9.0 dotnet-sdk-9.0 dotnet-sdk-9.0-source-built-artifacts dotnet-sdk-aot-9.0 dotnet-sdk-dbg-9.0 dotnet-targeting-pack-9.0 dotnet-templates-9.0 netstandard-targeting-pack-2.1 python3-unbound unbound unbound-anchor unbound-devel unbound-dracut unbound-libs cockpit-ha-cluster pcs pcs-snmp gstreamer1-plugins-bad-free gstreamer1-plugins-bad-free-devel gstreamer1-plugins-bad-free-libs mod_proxy_cluster xorg-x11-server-Xwayland xorg-x11-server-Xwayland-devel ipa-client ipa-client-common ipa-client-encrypted-dns ipa-client-epn ipa-client-samba ipa-common ipa-selinux ipa-selinux-luna ipa-selinux-nfast ipa-server ipa-server-common ipa-server-dns ipa-server-encrypted-dns ipa-server-trust-ad python3-ipaclient python3-ipalib python3-ipaserver python3-ipatests iputils sqlite sqlite-devel sqlite-libs java-21-openjdk java-21-openjdk-demo java-21-openjdk-demo-fastdebug java-21-openjdk-demo-slowdebug java-21-openjdk-devel java-21-openjdk-devel-fastdebug java-21-openjdk-devel-slowdebug java-21-openjdk-fastdebug java-21-openjdk-headless java-21-openjdk-headless-fastdebug java-21-openjdk-headless-slowdebug java-21-openjdk-javadoc java-21-openjdk-javadoc-zip java-21-openjdk-jmods java-21-openjdk-jmods-fastdebug java-21-openjdk-jmods-slowdebug java-21-openjdk-slowdebug java-21-openjdk-src java-21-openjdk-src-fastdebug java-21-openjdk-src-slowdebug java-21-openjdk-static-libs java-21-openjdk-static-libs-fastdebug java-21-openjdk-static-libs-slowdebug nodejs nodejs-devel nodejs-docs nodejs-full-i18n nodejs-libs nodejs-npm libsoup3 libsoup3-devel libsoup3-doc gnome-remote-desktop python3-setuptools python3-setuptools-wheel glibc glibc-all-langpacks glibc-benchtests glibc-common glibc-devel glibc-doc glibc-gconv-extra glibc-langpack-aa glibc-langpack-af glibc-langpack-agr glibc-langpack-ak glibc-langpack-am glibc-langpack-an glibc-langpack-anp glibc-langpack-ar glibc-langpack-as glibc-langpack-ast glibc-langpack-ayc glibc-langpack-az glibc-langpack-be glibc-langpack-bem glibc-langpack-ber glibc-langpack-bg glibc-langpack-bhb glibc-langpack-bho glibc-langpack-bi glibc-langpack-bn glibc-langpack-bo glibc-langpack-br glibc-langpack-brx glibc-langpack-bs glibc-langpack-byn glibc-langpack-ca glibc-langpack-ce glibc-langpack-chr glibc-langpack-ckb glibc-langpack-cmn glibc-langpack-crh glibc-langpack-cs glibc-langpack-csb glibc-langpack-cv glibc-langpack-cy glibc-langpack-da glibc-langpack-de glibc-langpack-doi glibc-langpack-dsb glibc-langpack-dv glibc-langpack-dz glibc-langpack-el glibc-langpack-en glibc-langpack-eo glibc-langpack-es glibc-langpack-et glibc-langpack-eu glibc-langpack-fa glibc-langpack-ff glibc-langpack-fi glibc-langpack-fil glibc-langpack-fo glibc-langpack-fr glibc-langpack-fur glibc-langpack-fy glibc-langpack-ga glibc-langpack-gbm glibc-langpack-gd glibc-langpack-gez glibc-langpack-gl glibc-langpack-gu glibc-langpack-gv glibc-langpack-ha glibc-langpack-hak glibc-langpack-he glibc-langpack-hi glibc-langpack-hif glibc-langpack-hne glibc-langpack-hr glibc-langpack-hsb glibc-langpack-ht glibc-langpack-hu glibc-langpack-hy glibc-langpack-ia glibc-langpack-id glibc-langpack-ig glibc-langpack-ik glibc-langpack-is glibc-langpack-it glibc-langpack-iu glibc-langpack-ja glibc-langpack-ka glibc-langpack-kab glibc-langpack-kk glibc-langpack-kl glibc-langpack-km glibc-langpack-kn glibc-langpack-ko glibc-langpack-kok glibc-langpack-ks glibc-langpack-ku glibc-langpack-kv glibc-langpack-kw glibc-langpack-ky glibc-langpack-lb glibc-langpack-lg glibc-langpack-li glibc-langpack-lij glibc-langpack-ln glibc-langpack-lo glibc-langpack-lt glibc-langpack-lv glibc-langpack-lzh glibc-langpack-mag glibc-langpack-mai glibc-langpack-mfe glibc-langpack-mg glibc-langpack-mhr glibc-langpack-mi glibc-langpack-miq glibc-langpack-mjw glibc-langpack-mk glibc-langpack-ml glibc-langpack-mn glibc-langpack-mni glibc-langpack-mnw glibc-langpack-mr glibc-langpack-ms glibc-langpack-mt glibc-langpack-my glibc-langpack-nan glibc-langpack-nb glibc-langpack-nds glibc-langpack-ne glibc-langpack-nhn glibc-langpack-niu glibc-langpack-nl glibc-langpack-nn glibc-langpack-nr glibc-langpack-nso glibc-langpack-oc glibc-langpack-om glibc-langpack-or glibc-langpack-os glibc-langpack-pa glibc-langpack-pap glibc-langpack-pl glibc-langpack-ps glibc-langpack-pt glibc-langpack-quz glibc-langpack-raj glibc-langpack-rif glibc-langpack-ro glibc-langpack-ru glibc-langpack-rw glibc-langpack-sa glibc-langpack-sah glibc-langpack-sat glibc-langpack-sc glibc-langpack-sd glibc-langpack-se glibc-langpack-sgs glibc-langpack-shn glibc-langpack-shs glibc-langpack-si glibc-langpack-sid glibc-langpack-sk glibc-langpack-sl glibc-langpack-sm glibc-langpack-so glibc-langpack-sq glibc-langpack-sr glibc-langpack-ss glibc-langpack-ssy glibc-langpack-st glibc-langpack-su glibc-langpack-sv glibc-langpack-sw glibc-langpack-syr glibc-langpack-szl glibc-langpack-ta glibc-langpack-tcy glibc-langpack-te glibc-langpack-tg glibc-langpack-th glibc-langpack-the glibc-langpack-ti glibc-langpack-tig glibc-langpack-tk glibc-langpack-tl glibc-langpack-tn glibc-langpack-to glibc-langpack-tok glibc-langpack-tpi glibc-langpack-tr glibc-langpack-ts glibc-langpack-tt glibc-langpack-ug glibc-langpack-uk glibc-langpack-unm glibc-langpack-ur glibc-langpack-uz glibc-langpack-ve glibc-langpack-vi glibc-langpack-wa glibc-langpack-wae glibc-langpack-wal glibc-langpack-wo glibc-langpack-xh glibc-langpack-yi glibc-langpack-yo glibc-langpack-yue glibc-langpack-yuw glibc-langpack-zgh glibc-langpack-zh glibc-langpack-zu glibc-locale-source glibc-minimal-langpack glibc-nss-devel glibc-static glibc-utils libnsl nss_db nss_hesiod glib2 glib2-devel glib2-doc glib2-static glib2-tests kea kea-doc kea-hooks kea-keama kea-libs freerdp freerdp-devel freerdp-libs freerdp-server libwinpr libwinpr-devel valkey valkey-devel libxml2 libxml2-devel libxml2-static python3-libxml2 rpm-ostree rpm-ostree-libs yggdrasil yggdrasil-devel wireshark wireshark-cli wireshark-devel tomcat9 tomcat9-admin-webapps tomcat9-docs-webapp tomcat9-el-3.0-api tomcat9-jsp-2.3-api tomcat9-lib tomcat9-servlet-4.0-api tomcat9-webapps libndp golang-race rsync rsync-daemon rsync-rrsync python-unversioned-command python3 python3-debug python3-devel python3-idle python3-libs python3-test python3-tkinter cloud-init sudo sudo-python-plugin openssl openssl-devel openssl-libs openssl-perl icu libicu libicu-devel jq jq-devel gdk-pixbuf2 gdk-pixbuf2-devel gdk-pixbuf2-modules python3-requests toolbox toolbox-tests openjpeg2 openjpeg2-devel openjpeg2-tools mod_http2 postgresql postgresql-contrib postgresql-docs postgresql-plperl postgresql-plpython3 postgresql-pltcl postgresql-private-devel postgresql-private-libs postgresql-server postgresql-server-devel postgresql-static postgresql-test postgresql-test-rpm-macros postgresql-upgrade postgresql-upgrade-devel httpd httpd-core httpd-devel httpd-filesystem httpd-manual httpd-tools mod_ldap mod_lua mod_proxy_html mod_session mod_ssl libudisks2 libudisks2-devel udisks2 udisks2-iscsi udisks2-lsm udisks2-lvm2 aide mysql-selinux mysql8.4 mysql8.4-common mysql8.4-devel mysql8.4-errmsg mysql8.4-libs mysql8.4-server mysql8.4-test mysql8.4-test-data cups cups-client cups-devel cups-filesystem cups-ipptool cups-libs cups-lpd cups-printerapp gnutls gnutls-c++ gnutls-dane gnutls-devel gnutls-fips gnutls-utils msvsphere-configs-common msvsphere-configs-gnome msvsphere-configs-gnome-software grub2-common grub2-efi-aa64 grub2-efi-aa64-cdboot grub2-efi-aa64-modules grub2-efi-x64 grub2-efi-x64-cdboot grub2-efi-x64-modules grub2-pc grub2-pc-modules grub2-tools grub2-tools-efi grub2-tools-extra grub2-tools-minimal avahi avahi-compat-howl avahi-compat-howl-devel avahi-compat-libdns_sd avahi-compat-libdns_sd-devel avahi-devel avahi-glib avahi-glib-devel avahi-libs avahi-tools libtpms command-line-assistant command-line-assistant-selinux /boot/grub2/grubenv saved_entry=.* 1 kernel kernel-64k kernel-64k-core kernel-64k-debug kernel-64k-debug-core kernel-64k-debug-devel kernel-64k-debug-devel-matched kernel-64k-debug-modules kernel-64k-debug-modules-core kernel-64k-debug-modules-extra kernel-64k-devel kernel-64k-devel-matched kernel-64k-modules kernel-64k-modules-core kernel-64k-modules-extra kernel-abi-stablelists kernel-core kernel-debug kernel-debug-core kernel-debug-devel kernel-debug-devel-matched kernel-debug-modules kernel-debug-modules-core kernel-debug-modules-extra kernel-debug-uki-virt kernel-devel kernel-devel-matched kernel-doc kernel-modules kernel-modules-core kernel-modules-extra kernel-rt kernel-rt-64k kernel-rt-64k-core kernel-rt-64k-debug kernel-rt-64k-debug-core kernel-rt-64k-debug-devel kernel-rt-64k-debug-modules kernel-rt-64k-debug-modules-core kernel-rt-64k-debug-modules-extra kernel-rt-64k-devel kernel-rt-64k-modules kernel-rt-64k-modules-core kernel-rt-64k-modules-extra kernel-rt-core kernel-rt-debug kernel-rt-debug-core kernel-rt-debug-devel kernel-rt-debug-kvm kernel-rt-debug-modules kernel-rt-debug-modules-core kernel-rt-debug-modules-extra kernel-rt-devel kernel-rt-kvm kernel-rt-modules kernel-rt-modules-core kernel-rt-modules-extra kernel-tools kernel-tools-libs kernel-tools-libs-devel kernel-uki-virt kernel-uki-virt-addons libperf perf python3-perf rtla rv perl-JSON-XS open-vm-tools open-vm-tools-desktop open-vm-tools-salt-minion open-vm-tools-sdmp open-vm-tools-test kernel-cross-headers kernel-headers chromedriver chromium chromium-common chromium-ffmpeg chromium-gost chromium-gost-common chromium-gost-ffmpeg chromium-gost-qt5-ui chromium-gost-qt6-ui chromium-headless chromium-qt5-ui chromium-qt6-ui kernel-64k-debug-modules-internal kernel-64k-debug-modules-partner kernel-64k-debug-uki-virt kernel-64k-debug-uki-virt-addons kernel-64k-modules-internal kernel-64k-modules-partner kernel-64k-uki-virt kernel-64k-uki-virt-addons kernel-debug-modules-internal kernel-debug-modules-partner kernel-debug-uki-virt-addons kernel-ipaclones-internal kernel-modules-internal kernel-modules-partner kernel-rt-64k-debug-devel-matched kernel-rt-64k-debug-kvm kernel-rt-64k-debug-modules-internal kernel-rt-64k-debug-modules-partner kernel-rt-64k-devel-matched kernel-rt-64k-kvm kernel-rt-64k-modules-internal kernel-rt-64k-modules-partner kernel-rt-debug-devel-matched kernel-rt-debug-modules-internal kernel-rt-debug-modules-partner kernel-rt-devel-matched kernel-rt-modules-internal kernel-rt-modules-partner kernel-selftests-internal libperf-devel libssh libssh-config libssh-devel libtiff libtiff-devel libtiff-tools vim-X11 vim-common vim-data vim-enhanced vim-filesystem vim-minimal xxd qt6-qtsvg qt6-qtsvg-devel qt6-qtsvg-examples libipa_hbac libsss_autofs libsss_certmap libsss_idmap libsss_nss_idmap libsss_nss_idmap-devel libsss_sudo python3-libipa_hbac python3-libsss_nss_idmap python3-sss python3-sss-murmur python3-sssdconfig sssd sssd-ad sssd-client sssd-common sssd-common-pac sssd-dbus sssd-idp sssd-ipa sssd-kcm sssd-krb5 sssd-krb5-common sssd-ldap sssd-nfs-idmap sssd-passkey sssd-proxy sssd-tools sssd-winbind-idmap bind bind-chroot bind-devel bind-dnssec-utils bind-doc bind-libs bind-license bind-utils haproxy qt6-qtquick3d qt6-qtquick3d-devel qt6-qtquick3d-examples squid pam pam-devel pam-libs shadow-utils shadow-utils-subid shadow-utils-subid-devel binutils binutils-devel binutils-gold openssh openssh-askpass openssh-clients openssh-keycat openssh-keysign openssh-server zziplib zziplib-devel zziplib-utils kernel-modules-extra-matched java-25-openjdk java-25-openjdk-demo java-25-openjdk-demo-fastdebug java-25-openjdk-demo-slowdebug java-25-openjdk-devel java-25-openjdk-devel-fastdebug java-25-openjdk-devel-slowdebug java-25-openjdk-fastdebug java-25-openjdk-headless java-25-openjdk-headless-fastdebug java-25-openjdk-headless-slowdebug java-25-openjdk-javadoc java-25-openjdk-javadoc-zip java-25-openjdk-jmods java-25-openjdk-jmods-fastdebug java-25-openjdk-jmods-slowdebug java-25-openjdk-slowdebug java-25-openjdk-src java-25-openjdk-src-fastdebug java-25-openjdk-src-slowdebug java-25-openjdk-static-libs java-25-openjdk-static-libs-fastdebug java-25-openjdk-static-libs-slowdebug python3-kdcproxy aspnetcore-runtime-10.0 aspnetcore-runtime-dbg-10.0 aspnetcore-targeting-pack-10.0 dotnet-apphost-pack-10.0 dotnet-hostfxr-10.0 dotnet-runtime-10.0 dotnet-runtime-dbg-10.0 dotnet-sdk-10.0 dotnet-sdk-10.0-source-built-artifacts dotnet-sdk-aot-10.0 dotnet-sdk-dbg-10.0 dotnet-targeting-pack-10.0 dotnet-templates-10.0 x86_64|aarch64 1:0.82-13.1.el10_0 1:10.1.36-1.el10_0 x86_64|aarch64 0:2.4.15-4.el10_0.1 x86_64|aarch64 0:0.9.27-3.el10_0 0:1.9.4-21.el10_0 x86_64|aarch64 6:5.4.0-9.el10_0 6:5.4.0-9.el10_0 x86_64|aarch64 0:2.47.1-2.el10_0 0:2.47.1-2.el10_0 x86_64|aarch64 0:3.2.0-4.el10_0 x86_64|aarch64 0:3.1.9-1.el10_0.1 x86_64|aarch64 0:128.9.0-2.el10_0.inferit x86_64|aarch64 0:8.3.19-1.el10_0 x86_64|aarch64 0:0.107.0-9.el10_0 x86_64|aarch64 0:3.7.7-3.el10_0 x86_64|aarch64 0:1.21.3-8.el10_0 x86_64|aarch64 0:128.11.0-1.el10_0.inferit x86_64|aarch64 2:1.18.1-1.el10_0 x86_64|aarch64 0:6.8.1-9.el10_0 0:6.8.1-9.el10_0 x86_64|aarch64 2:1.39.4-1.el10_0 x86_64|aarch64 0:2.7.1-1.el10_0 x86_64|aarch64 0:0.28.3-3.el10_0.2 0:0.28.3-3.el10_0.2 x86_64|aarch64 1:5.6.2-4.el10_0 x86_64|aarch64 0:10.02.1-16.el10_0 0:10.02.1-16.el10_0 x86_64|aarch64 0:1.23.9-1.el10_0 0:1.23.9-1.el10_0 x86_64|aarch64 0:7.6.1-2.el10_0.1 x86_64|aarch64 0:134.1-2.el10_0.inferit.1 x86_64|aarch64 0:3.6.1-2.el10_0 x86_64|aarch64 0:5.2.2-3.el10_0 x86_64|aarch64 0:1.14.1-3.el10_0 x86_64|aarch64 2:1.39.4-2.el10_0 x86_64|aarch64 0:1.1.39-7.el10_0 x86_64|aarch64 2:1.18.1-2.el10_0 0:3.1.6-1.el10_0 x86_64|aarch64 4:5.40.2-512.1.el10_0 0:1.03-512.1.el10_0 0:5.74-512.1.el10_0 x86_64|aarch64 0:1.89-512.1.el10_0 0:1.25-512.1.el10_0 0:0.68-512.1.el10_0 0:0.03-512.1.el10_0 0:0.06-512.1.el10_0 x86_64|aarch64 0:1.34-512.1.el10_0 0:1.06-512.1.el10_0 0:1.05-512.1.el10_0 0:2.27-512.1.el10_0 x86_64|aarch64 0:1.56-512.1.el10_0 0:1.11-512.1.el10_0 x86_64|aarch64 0:1.38-512.1.el10_0 0:0.25-512.1.el10_0 0:1.35-512.1.el10_0 0:1.14-512.1.el10_0 x86_64|aarch64 0:1.18-512.1.el10_0 0:2.86-512.1.el10_0 0:1.100.800-512.1.el10_0 0:2.41-512.1.el10_0 x86_64|aarch64 0:1.12-512.1.el10_0 0:1.44-512.1.el10_0 0:1.10-512.1.el10_0 0:2.05-512.1.el10_0 0:1.54-512.1.el10_0 x86_64|aarch64 1:1.24-512.1.el10_0 x86_64|aarch64 0:0.32-512.1.el10_0 x86_64|aarch64 0:1.27-512.1.el10_0 0:1.02-512.1.el10_0 0:0.45-512.1.el10_0 x86_64|aarch64 0:0.24-512.1.el10_0 x86_64|aarch64 0:1.55-512.1.el10_0 0:1.22-512.1.el10_0 1:0.21-512.1.el10_0 0:1.62-512.1.el10_0 0:1.16-512.1.el10_0 1:0.08-512.1.el10_0 x86_64|aarch64 0:1.17-512.1.el10_0 0:0.69-512.1.el10_0 0:1.04-512.1.el10_0 x86_64|aarch64 0:1.65-512.1.el10_0 x86_64|aarch64 0:2.20-512.1.el10_0 0:2.46-512.1.el10_0 0:1.07-512.1.el10_0 0:1.27-512.1.el10_0 0:1.09-512.1.el10_0 x86_64|aarch64 0:1.25-512.1.el10_0 0:1.403-512.1.el10_0 0:1.17-512.1.el10_0 0:1.31-512.1.el10_0 0:3.05-512.1.el10_0 0:2.13-512.1.el10_0 0:4.6-512.1.el10_0 0:1.1-512.1.el10_0 x86_64|aarch64 0:1.3401-512.1.el10_0 0:0.78-512.1.el10_0 0:1.60-512.1.el10_0 0:0.04-512.1.el10_0 0:1.40-512.1.el10_0 0:5.40.2-512.1.el10_0 0:0.14-512.1.el10_0 0:0.61.000-512.1.el10_0 x86_64|aarch64 0:0.65-512.1.el10_0 4:5.40.2-512.1.el10_0 0:1.12-512.1.el10_0 x86_64|aarch64 0:1.29-512.1.el10_0 0:1.13-512.1.el10_0 0:1.37-512.1.el10_0 0:0.02-512.1.el10_0 x86_64|aarch64 0:5.40.2-512.1.el10_0 x86_64|aarch64 0:3.3.8-10.el10_0 0:3.3.8-10.el10_0 x86_64|aarch64 0:3.1.5-10.el10_0 0:2.5.22-10.el10_0 x86_64|aarch64 0:0.7.1-10.el10_0 0:1.13.1-10.el10_0 x86_64|aarch64 0:2.7.2-10.el10_0 0:5.20.0-10.el10_0 0:2.0.3-10.el10_0 x86_64|aarch64 0:5.1.2-10.el10_0 x86_64|aarch64 0:1.7.3-10.el10_0 0:13.1.0-10.el10_0 x86_64|aarch64 0:3.4.0-10.el10_0 0:6.6.3.1-10.el10_0 0:3.3.9-10.el10_0 0:0.3.1-10.el10_0 0:3.6.1-10.el10_0 0:0.21.9-10.el10_0 0:3.5.22-10.el10_0 x86_64|aarch64 6:0.8.5-2.el10_0 x86_64|aarch64 0:6.4.2-1.el10_0.1 x86_64|aarch64 0:8.0.17-1.el10_0 x86_64|aarch64 0:8.0.117-1.el10_0 x86_64|aarch64 0:10.2.6-18.el10_0 x86_64|aarch64 0:1.24.1-2.el10_0 x86_64|aarch64 0:134.1-1.el10_0.inferit.1 x86_64|aarch64 0:10.2.6-17.el10_0 x86_64|aarch64 0:8.0.16-1.el10_0 x86_64|aarch64 0:8.0.116-1.el10_0 x86_64|aarch64 0:9.0.5-1.el10_0 x86_64|aarch64 0:9.0.106-1.el10_0 x86_64|aarch64 0:1.20.0-10.el10_0 x86_64|aarch64 0:128.10.1-1.el10_0.inferit x86_64|aarch64 0:1.24.1-1.el10_0 x86_64|aarch64 0:1.23.7-1.el10_0 0:1.23.7-1.el10_0 x86_64|aarch64 6:5.4.0-10.el10_0 6:5.4.0-10.el10_0 x86_64|aarch64 0:3.7.7-2.el10_0 x86_64|aarch64 6:0.8.5-1.el10_0 x86_64|aarch64 0:10.2.6-15.el10_0 0:0.12.0-3.el10_0.2 x86_64|aarch64 0:0.12.0-3.el10_0.2 x86_64|aarch64 0:1.24.11-2.el10_0 x86_64|aarch64 0:9.0.6-1.el10_0 x86_64|aarch64 0:9.0.107-1.el10_0 x86_64|aarch64 0:1.3.22-1.el10_0.2 x86_64|aarch64 0:24.1.5-4.el10_0 x86_64|aarch64 0:4.12.2-15.el10_0.1 0:4.12.2-15.el10_0.1 x86_64|aarch64 0:24.1.5-3.el10_0 x86_64|aarch64 0:128.10.0-1.el10_0.inferit x86_64|aarch64 0:20240905-2.el10_0.1 x86_64|aarch64 0:3.46.1-4.el10_0.inferit x86_64|aarch64 0:10.02.1-15.el10_0 0:10.02.1-15.el10_0 x86_64|aarch64 1:21.0.7.0.6-1.el10.inferit x86_64|aarch64 1:22.16.0-1.el10_0 1:22.16.0-1.el10_0 x86_64|aarch64 1:10.9.2-1.22.16.0.1.el10_0 x86_64|aarch64 0:3.6.5-3.el10_0.6 0:3.6.5-3.el10_0.6 x86_64|aarch64 0:3.6.5-3.el10_0 0:3.6.5-3.el10_0 x86_64|aarch64 1:22.15.0-1.el10_0 1:22.15.0-1.el10_0 x86_64|aarch64 1:10.9.2-1.22.15.0.1.el10_0 x86_64|aarch64 0:47.3-2.el10_0 0:69.0.3-12.el10_0 x86_64|aarch64 0:128.12.0-1.el10_0.inferit x86_64|aarch64 0:2.39-43.el10_0 0:2.39-43.el10_0 x86_64|aarch64 0:2.80.4-4.el10_0.6.inferit x86_64|aarch64 0:2.6.3-1.el10_0 0:2.6.3-1.el10_0 x86_64|aarch64 2:3.10.3-3.el10_0 x86_64|aarch64 0:8.0.3-1.el10_0 x86_64|aarch64 0:2.12.5-5.el10_0 x86_64|aarch64 0:2025.5-1.el10 x86_64|aarch64 0:0.4.5-3.el10_0 x86_64|aarch64 1:4.4.2-3.el10_0 1:9.0.87-5.el10_0 x86_64|aarch64 0:1.9-2.el10 x86_64|aarch64 0:1.24.4-1.el10_0 0:1.24.4-1.el10_0 x86_64|aarch64 0:3.4.1-2.el10 0:3.4.1-2.el10 x86_64|aarch64 6:5.4.0-12.el10_0 6:5.4.0-12.el10_0 0:3.12.9-2.el10_0.2 x86_64|aarch64 0:3.12.9-2.el10_0.2 0:24.4-3.el10_0.2.inferit x86_64|aarch64 0:2.12.5-7.el10_0 1:9.0.87-5.el10_0.1 x86_64|aarch64 0:1.3.21-1.el10 x86_64|aarch64 0:8.0.4-1.el10_0 x86_64|aarch64 0:2.47.3-1.el10_0 0:2.47.3-1.el10_0 x86_64|aarch64 0:1.9.15-8.p5.el10_0.2 x86_64|aarch64 1:3.2.2-16.el10.inferit x86_64|aarch64 0:128.13.0-1.el10_0.inferit x86_64|aarch64 0:3.46.1-5.el10_0.inferit x86_64|aarch64 0:128.13.0-3.el10_0.inferit x86_64|aarch64 0:1.20.0-12.el10_0 x86_64|aarch64 4:5.40.2-512.2.el10_0 0:1.03-512.2.el10_0 0:5.74-512.2.el10_0 x86_64|aarch64 0:1.89-512.2.el10_0 0:1.25-512.2.el10_0 0:0.68-512.2.el10_0 0:0.03-512.2.el10_0 0:0.06-512.2.el10_0 x86_64|aarch64 0:1.34-512.2.el10_0 0:1.06-512.2.el10_0 0:1.05-512.2.el10_0 0:2.27-512.2.el10_0 x86_64|aarch64 0:1.56-512.2.el10_0 0:1.11-512.2.el10_0 x86_64|aarch64 0:1.38-512.2.el10_0 0:0.25-512.2.el10_0 0:1.35-512.2.el10_0 0:1.14-512.2.el10_0 x86_64|aarch64 0:1.18-512.2.el10_0 0:2.86-512.2.el10_0 0:1.100.800-512.2.el10_0 0:2.41-512.2.el10_0 x86_64|aarch64 0:1.12-512.2.el10_0 0:1.44-512.2.el10_0 0:1.10-512.2.el10_0 0:2.05-512.2.el10_0 0:1.54-512.2.el10_0 x86_64|aarch64 1:1.24-512.2.el10_0 x86_64|aarch64 0:0.32-512.2.el10_0 x86_64|aarch64 0:1.27-512.2.el10_0 0:1.02-512.2.el10_0 0:0.45-512.2.el10_0 x86_64|aarch64 0:0.24-512.2.el10_0 x86_64|aarch64 0:1.55-512.2.el10_0 0:1.22-512.2.el10_0 1:0.21-512.2.el10_0 0:1.62-512.2.el10_0 0:1.16-512.2.el10_0 1:0.08-512.2.el10_0 x86_64|aarch64 0:1.17-512.2.el10_0 0:0.69-512.2.el10_0 0:1.04-512.2.el10_0 x86_64|aarch64 0:1.65-512.2.el10_0 x86_64|aarch64 0:2.20-512.2.el10_0 0:2.46-512.2.el10_0 0:1.07-512.2.el10_0 0:1.27-512.2.el10_0 0:1.09-512.2.el10_0 x86_64|aarch64 0:1.25-512.2.el10_0 0:1.403-512.2.el10_0 0:1.17-512.2.el10_0 0:1.31-512.2.el10_0 0:3.05-512.2.el10_0 0:2.13-512.2.el10_0 0:4.6-512.2.el10_0 0:1.1-512.2.el10_0 x86_64|aarch64 0:1.3401-512.2.el10_0 0:0.78-512.2.el10_0 0:1.60-512.2.el10_0 0:0.04-512.2.el10_0 0:1.40-512.2.el10_0 0:5.40.2-512.2.el10_0 0:0.14-512.2.el10_0 0:0.61.000-512.2.el10_0 x86_64|aarch64 0:0.65-512.2.el10_0 4:5.40.2-512.2.el10_0 0:1.12-512.2.el10_0 x86_64|aarch64 0:1.29-512.2.el10_0 0:1.13-512.2.el10_0 0:1.37-512.2.el10_0 0:0.02-512.2.el10_0 x86_64|aarch64 0:5.40.2-512.2.el10_0 x86_64|aarch64 0:74.2-5.el10_0 x86_64|aarch64 0:2.39-46.el10_0 0:2.39-46.el10_0 x86_64|aarch64 0:1.7.1-8.el10_0.1 x86_64|aarch64 0:2.42.12-4.el10_0 x86_64|aarch64 0:0.127.0-1.el10_0 x86_64|aarch64 0:2.12.5-9.el10_0 0:2.32.4-1.el10_0 x86_64|aarch64 0:0.2-1.el10_0 x86_64|aarch64 0:2.5.2-4.el10_0.1 x86_64|aarch64 0:1.24.6-1.el10_0 0:1.24.6-1.el10_0 x86_64|aarch64 0:3.7.7-4.el10_0 1:9.0.87-5.el10_0.3 1:10.1.36-1.el10_0.2 x86_64|aarch64 0:2.0.29-2.el10_0.1 x86_64|aarch64 0:16.10-1.el10_0 0:16.10-1.el10_0 x86_64|aarch64 0:2.4.63-1.el10_0.2.inferit 0:2.4.63-1.el10_0.2.inferit x86_64|aarch64 1:2.4.63-1.el10_0.2.inferit x86_64|aarch64 0:2.10.90-5.el10_0.1 0:3.12.9-2.el10_0.3 x86_64|aarch64 0:3.12.9-2.el10_0.3 x86_64|aarch64 0:0.18.6-8.el10_0.2 x86_64|aarch64 0:128.14.0-2.el10_0.inferit x86_64|aarch64 0:128.14.0-3.el10_0.inferit 0:1.0.14-1.el10_0 x86_64|aarch64 0:8.4.6-2.el10_0 0:8.4.6-2.el10_0 x86_64|aarch64 1:2.4.10-11.el10_0.1 1:2.4.10-11.el10_0.1 x86_64|aarch64 6:5.4.0-13.el10_0 6:5.4.0-13.el10_0 x86_64|aarch64 0:140.3.0-1.el10_0.inferit x86_64|aarch64 0:3.8.9-9.el10_0.14.inferit 0:10.5-1.el10_0 1:2.12-15.el10_0.inferit aarch64 1:2.12-15.el10_0.inferit x86_64 1:2.12-15.el10_0.inferit x86_64|aarch64 1:2.12-15.el10_0.inferit x86_64|aarch64 0:0.9~rc2-1.el10_0.1 x86_64|aarch64 0:0.127.0-3.el10_0 x86_64|aarch64 0:0.9.6-11.el10_0 0:0.3.1-6.el10_0 x86_64|aarch64 1:4.04-1.el10_0 x86_64|aarch64 0:4.12.2-15.el10_0.4 0:4.12.2-15.el10_0.4 x86_64|aarch64 0:12.5.0-1.el10_0.1 x86_64 0:12.5.0-1.el10_0.1 x86_64|aarch64 0:140.0.7339.207-1.el10_0.inferit ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9])\.)|(6\.12\.0-55\.20\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.20\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9])\.)|(6\.12\.0-55\.20\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.20\.0\.) x86_64|aarch64 0:6.12.0-55.20.1.el10_0.3 aarch64 0:6.12.0-55.20.1.el10_0.3 0:6.12.0-55.20.1.el10_0.3 x86_64 0:6.12.0-55.20.1.el10_0.3 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-7])\.)|(6\.12\.0-55\.38\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.38\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-7])\.)|(6\.12\.0-55\.38\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.38\.0\.) x86_64|aarch64 0:6.12.0-55.38.1.el10_0 aarch64 0:6.12.0-55.38.1.el10_0 0:6.12.0-55.38.1.el10_0 x86_64 0:6.12.0-55.38.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|20)\.)|(6\.12\.0-55\.21\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.21\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|20)\.)|(6\.12\.0-55\.21\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.21\.0\.) x86_64|aarch64 0:6.12.0-55.21.1.el10_0 aarch64 0:6.12.0-55.21.1.el10_0 0:6.12.0-55.21.1.el10_0 x86_64 0:6.12.0-55.21.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-1])\.)|(6\.12\.0-55\.22\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.22\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-1])\.)|(6\.12\.0-55\.22\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.22\.0\.) x86_64|aarch64 0:6.12.0-55.22.1.el10_0 aarch64 0:6.12.0-55.22.1.el10_0 0:6.12.0-55.22.1.el10_0 x86_64 0:6.12.0-55.22.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-8])\.)|(6\.12\.0-55\.29\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.29\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-8])\.)|(6\.12\.0-55\.29\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.29\.0\.) x86_64|aarch64 0:6.12.0-55.29.1.el10_0 aarch64 0:6.12.0-55.29.1.el10_0 0:6.12.0-55.29.1.el10_0 x86_64 0:6.12.0-55.29.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-6])\.)|(6\.12\.0-55\.27\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.27\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-6])\.)|(6\.12\.0-55\.27\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.27\.0\.) x86_64|aarch64 0:6.12.0-55.27.1.el10_0 aarch64 0:6.12.0-55.27.1.el10_0 0:6.12.0-55.27.1.el10_0 x86_64 0:6.12.0-55.27.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-3])\.)|(6\.12\.0-55\.24\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.24\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-3])\.)|(6\.12\.0-55\.24\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.24\.0\.) x86_64|aarch64 0:6.12.0-55.24.1.el10_0 aarch64 0:6.12.0-55.24.1.el10_0 0:6.12.0-55.24.1.el10_0 x86_64 0:6.12.0-55.24.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-4])\.)|(6\.12\.0-55\.25\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.25\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-4])\.)|(6\.12\.0-55\.25\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.25\.0\.) x86_64|aarch64 0:6.12.0-55.25.1.el10_0 aarch64 0:6.12.0-55.25.1.el10_0 0:6.12.0-55.25.1.el10_0 x86_64 0:6.12.0-55.25.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-7])\.)|(6\.12\.0-55\.28\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.28\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-7])\.)|(6\.12\.0-55\.28\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.28\.0\.) x86_64|aarch64 0:6.12.0-55.28.1.el10_0 aarch64 0:6.12.0-55.28.1.el10_0 0:6.12.0-55.28.1.el10_0 x86_64 0:6.12.0-55.28.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-2])\.)|(6\.12\.0-55\.33\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.33\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-2])\.)|(6\.12\.0-55\.33\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.33\.0\.) x86_64|aarch64 0:6.12.0-55.33.1.el10_0 aarch64 0:6.12.0-55.33.1.el10_0 0:6.12.0-55.33.1.el10_0 x86_64 0:6.12.0-55.33.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|30)\.)|(6\.12\.0-55\.31\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.31\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|30)\.)|(6\.12\.0-55\.31\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.31\.0\.) x86_64|aarch64 0:6.12.0-55.31.1.el10_0 aarch64 0:6.12.0-55.31.1.el10_0 0:6.12.0-55.31.1.el10_0 x86_64 0:6.12.0-55.31.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-3])\.)|(6\.12\.0-55\.34\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.34\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-3])\.)|(6\.12\.0-55\.34\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.34\.0\.) x86_64|aarch64 0:6.12.0-55.34.1.el10_0 aarch64 0:6.12.0-55.34.1.el10_0 0:6.12.0-55.34.1.el10_0 x86_64 0:6.12.0-55.34.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-1])\.)|(6\.12\.0-55\.32\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.32\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-1])\.)|(6\.12\.0-55\.32\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.32\.0\.) x86_64|aarch64 0:6.12.0-55.32.1.el10_0 aarch64 0:6.12.0-55.32.1.el10_0 0:6.12.0-55.32.1.el10_0 x86_64 0:6.12.0-55.32.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-9])\.)|(6\.12\.0-55\.30\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.30\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|1[0-9]|2[0-9])\.)|(6\.12\.0-55\.30\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.30\.0\.) x86_64|aarch64 0:6.12.0-55.30.1.el10_0 aarch64 0:6.12.0-55.30.1.el10_0 0:6.12.0-55.30.1.el10_0 x86_64 0:6.12.0-55.30.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-6])\.)|(6\.12\.0-55\.37\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.37\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-6])\.)|(6\.12\.0-55\.37\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.37\.0\.) x86_64|aarch64 0:6.12.0-55.37.1.el10_0 aarch64 0:6.12.0-55.37.1.el10_0 0:6.12.0-55.37.1.el10_0 x86_64 0:6.12.0-55.37.1.el10_0 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-8])\.)|(6\.12\.0-55\.39\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.39\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-8])\.)|(6\.12\.0-55\.39\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.39\.0\.) x86_64|aarch64 0:6.12.0-55.39.1.el10_0 aarch64 0:6.12.0-55.39.1.el10_0 0:6.12.0-55.39.1.el10_0 x86_64 0:6.12.0-55.39.1.el10_0 x86_64|aarch64 0:8.0.21-1.el10_0 x86_64|aarch64 0:8.0.121-1.el10_0 x86_64|aarch64 0:140.4.0-3.el10_0.inferit x86_64|aarch64 0:9.0.10-1.el10_0 x86_64|aarch64 0:9.0.111-1.el10_0 x86_64|aarch64 0:3.6.5-3.el10_0.7 0:3.6.5-3.el10_0.7 x86_64|aarch64 0:0.11.1-4.el10_0 0:0.11.1-4.el10_0 x86_64|aarch64 0:140.4.0-2.el10_0.inferit ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-9])\.)|(6\.12\.0-55\.40\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.40\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-2][0-9]|3[0-9])\.)|(6\.12\.0-55\.40\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.40\.0\.) x86_64|aarch64 0:6.12.0-55.40.1.el10_0 aarch64 0:6.12.0-55.40.1.el10_0 0:6.12.0-55.40.1.el10_0 x86_64 0:6.12.0-55.40.1.el10_0 x86_64|aarch64 0:4.6.0-6.el10_0.1 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|40)\.)|(6\.12\.0-55\.41\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.41\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|40)\.)|(6\.12\.0-55\.41\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.41\.0\.) x86_64|aarch64 0:6.12.0-55.41.1.el10_0 aarch64 0:6.12.0-55.41.1.el10_0 0:6.12.0-55.41.1.el10_0 x86_64 0:6.12.0-55.41.1.el10_0 x86_64|aarch64 0:2.7.1-1.el10_0.3 x86_64|aarch64 0:8.0.6-1.el10_0 x86_64|aarch64 0:134.1-3.el10_0.inferit x86_64|aarch64 0:3.6.5-3.el10_0.9 0:3.6.5-3.el10_0.9 x86_64|aarch64 2:9.1.083-5.el10_0.1 2:9.1.083-5.el10_0.1 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|4[0-1])\.)|(6\.12\.0-55\.42\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.42\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|4[0-1])\.)|(6\.12\.0-55\.42\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.42\.0\.) x86_64|aarch64 0:6.12.0-55.42.1.el10_0 aarch64 0:6.12.0-55.42.1.el10_0 0:6.12.0-55.42.1.el10_0 x86_64 0:6.12.0-55.42.1.el10_0 x86_64|aarch64 0:24.1.5-5.el10_0 0:0.12.0-3.el10_0.3 x86_64|aarch64 0:0.12.0-3.el10_0.3 x86_64|aarch64 0:6.8.1-1.el10_0.1 x86_64|aarch64 0:2.10.2-3.el10_0.3 0:2.10.2-3.el10_0.3 x86_64|aarch64 32:9.18.33-4.el10_0.2 32:9.18.33-4.el10_0.2 x86_64|aarch64 0:3.0.5-4.el10_1.1 x86_64|aarch64 0:1.25.2-1.el10_1 x86_64|aarch64 0:1.25.3-1.el10_1 0:1.25.3-1.el10_1 x86_64|aarch64 0:6.9.1-1.el10_1.1 x86_64|aarch64 7:6.10-6.el10_1.1 x86_64|aarch64 0:0.11.1-4.el10_1 0:0.11.1-4.el10_1 x86_64|aarch64 0:2.11.1-2.el10_1.1 0:2.11.1-2.el10_1.1 x86_64|aarch64 0:4.12.2-24.el10_1.1 0:4.12.2-24.el10_1.1 x86_64|aarch64 0:3.0.1-1.el10_1 0:3.0.1-1.el10_1 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|4[0-2])\.)|(6\.12\.0-55\.43\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.43\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]|[1-4][0-9]|5[0-4])\.)|(6\.12\.0-55\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.([0-9]|[1-3][0-9]|4[0-2])\.)|(6\.12\.0-55\.43\.[^\.]*[a-zA-Z])|(6\.12\.0-55\.43\.0\.) x86_64|aarch64 0:6.12.0-55.43.1.el10_0 aarch64 0:6.12.0-55.43.1.el10_0 0:6.12.0-55.43.1.el10_0 x86_64 0:6.12.0-55.43.1.el10_0 x86_64|aarch64 0:1.6.1-8.el10 x86_64|aarch64 2:4.15.0-8.el10 x86_64|aarch64 0:2.41-58.el10 x86_64|aarch64 0:9.9p1-11.el10 x86_64|aarch64 0:0.13.78-2.el10 x86_64|aarch64 7:5.6.0-6.el10_1 7:5.6.0-6.el10_1 x86_64|aarch64 2:9.1.083-6.el10_1 2:9.1.083-6.el10_1 x86_64|aarch64 0:4.6.0-6.el10_1.1 x86_64|aarch64 7:5.6.0-5.el10_1 7:5.6.0-5.el10_1 x86_64|aarch64 0:6.9.1-2.el10_1.2 x86_64|aarch64 0:2.7.1-1.el10_1.3 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|10)\.)|(6\.12\.0-124\.11\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.11\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|10)\.)|(6\.12\.0-124\.11\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.11\.0\.) x86_64|aarch64 0:6.12.0-124.11.1.el10_1 aarch64 0:6.12.0-124.11.1.el10_1 0:6.12.0-124.11.1.el10_1 x86_64 0:6.12.0-124.11.1.el10_1 x86_64|aarch64 1:25.0.1.0.8-2.el10 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|1[0-2])\.)|(6\.12\.0-124\.13\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.13\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|1[0-2])\.)|(6\.12\.0-124\.13\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.13\.0\.) x86_64|aarch64 0:6.12.0-124.13.1.el10_1 aarch64 0:6.12.0-124.13.1.el10_1 0:6.12.0-124.13.1.el10_1 x86_64 0:6.12.0-124.13.1.el10_1 x86_64|aarch64 32:9.18.33-10.el10_1.2 32:9.18.33-10.el10_1.2 x86_64|aarch64 0:3.0.1-2.el10_1 0:3.0.1-2.el10_1 x86_64|aarch64 0:140.5.0-2.el10_1.inferit 0:1.0.0-19.el10_1 x86_64|aarch64 0:24.1.5-5.el10_1 x86_64|aarch64 1:3.5.1-4.el10_1.inferit x86_64|aarch64 0:3.6.5-3.el10_1.6 0:3.6.5-3.el10_1.6 0:0.12.1-1.el10_1.1 x86_64|aarch64 0:0.12.1-1.el10_1.1 x86_64|aarch64 0:6.9.1-2.el10_1.1 x86_64|aarch64 2:1.41.6-1.el10_1 ([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|1[0-5])\.)|(6\.12\.0-124\.16\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.16\.0\.) saved_entry=\w*-([0-5]\.\d+\.\d+-)|(6\.([0-9]|1[0-1])\.\d+-)|(6\.12\.0-([0-9]{1,2}|1[0-1][0-9]|12[0-3])\.)|(6\.12\.0-124\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.([0-9]|1[0-5])\.)|(6\.12\.0-124\.16\.[^\.]*[a-zA-Z])|(6\.12\.0-124\.16\.0\.) x86_64|aarch64 0:6.12.0-124.16.1.el10_1 aarch64 0:6.12.0-124.16.1.el10_1 0:6.12.0-124.16.1.el10_1 x86_64 0:6.12.0-124.16.1.el10_1 x86_64|aarch64 0:8.0.6-2.el10_1 x86_64|aarch64 0:10.0.0~rc.2.25502.107-0.12.el10_1 x86_64|aarch64 0:10.0.100~rc.2.25502.107-0.12.el10_1