#vulnerability

## Summary PostQuantum-Feldman-VSS, in versions ≤0.7.6b0, is vulnerable due to its dependency on gmpy2, which can crash the Python interpreter if memory allocation fails. This can be exploited for denial-of-service attacks, impacting the availability of systems using the library. ## Description The vulnerability arises from gmpy2’s behavior, as noted in its documentation: > gmpy2 can crash the Python interpreter in case of memory allocation failure ([gmpy2 Overview](https://gmpy2.readthedocs.io/en/latest/overview.html)) This stems from gmpy2’s reliance on the GMP library, which terminates the program when memory allocation fails ([GMP Memory Management](https://gmplib.org/manual/Memory-Management)). An attacker can exploit this by crafting inputs that exhaust memory, causing the interpreter to crash and disrupting service for legitimate users. ## Impact - **Availability**: High impact, as the interpreter crash leads to complete denial of service. - **Confidentiality and Integrity*...

### Impact Zincati ships a polkit rule which allows the `zincati` system user to use the following actions: - `org.projectatomic.rpmostree1.deploy`: used to deploy updates to the system - `org.projectatomic.rpmostree1.finalize-deployment`: used to reboot the system into the deployed update Since Zincati [v0.0.24](https://github.com/coreos/zincati/releases/tag/v0.0.24), this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus sock...

GitHub security alert: Malicious code found in ‘tj-actions/changed-files,’ impacting 23K+ repos. Learn how to check, remove, and protect…

An unpatched security flaw impacting the Edimax IC-7100 network camera is being exploited by threat actors to deliver Mirat botnet malware variants since at least May 2024. The vulnerability in question is CVE-2025-1316 (CVSS v4 score: 9.3), a critical operating system command injection flaw that an attacker could exploit to achieve remote code execution on susceptible devices by means of a

Scammers are sending fake extortion and ransom demands while posing as ransomware gangs, including the notorious Cl0p ransomware.…

A list of topics we covered in the week of March 10 to March 16 of 2025

gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.

Did you know that 43% of cyberattacks target small businesses, yet only 14% are prepared to defend themselves?…

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.