Tag Archives: LinuxPatchWednesday

I added support for ALT Linux OVAL content in Linux Patch Wednesday

Leave a reply

I added support for ALT Linux OVAL content in Linux Patch Wednesday

I added support for ALT Linux OVAL content in Linux Patch Wednesday. Now I track when specific CVEs were fixed in ALT Linux packages and take that into account when generating the monthly bulletins. The more data sources on patched vulnerabilities in Linux distributions are used, the more accurate the bulletins become. 👍 Especially when those Linux distributions are independent, not derivatives. 😇

Currently, the LPW generator uses 7 OVAL sources:

🔹 Debian
🔹 Ubuntu
🔹 Oracle Linux
🔹 RedOS
🔹 AlmaLinux
🔹 Red Hat
🔹 ALT Linux

Plus one more source from Debian’s mailing list.

I'm a bit late with the June Linux Patch Wednesday review (due to these improvements and my vacation), but I plan to release it soon. Especially since there aren't that many vulnerabilities this time - only 598. 🙂

На русском

May

1 Reply

May

May Linux Patch Wednesday. This time: 1091 vulnerabilities. Of those, 716 are in the Linux Kernel. 🤯 5 vulnerabilities are exploited in the wild:

🔻 RCE - PHP CSS Parser (CVE-2020-13756). In AttackerKB, an exploit exists.
🔻 DoS - Apache ActiveMQ (CVE-2025-27533). In AttackerKB, an exploit exists.
🔻 SFB - Chromium (CVE-2025-4664). In CISA KEV.
🔻 PathTrav - buildkit (CVE-2024-23652) and MemCor - buildkit (CVE-2024-23651). In BDU FSTEC.

For 52 (❗️) more, there are signs of existing public exploits. Two trending vulnerabilities I've mentioned before::

🔸 RCE - Kubernetes "IngressNightmare" (CVE-2025-1974 and 4 others)
🔸 RCE - Erlang/OTP (CVE-2025-32433)

Exploits for these are also notable:

🔸 EoP - Linux Kernel (CVE-2023-53033)
🔸 XSS - Horde IMP (CVE-2025-30349)
🔸 PathTrav - tar-fs (CVE-2024-12905)
🔸 SFB - kitty (CVE-2025-43929)
🔸 DoS - libxml2 (CVE-2025-32414)

🗒 Full Vulristics report

На русском

April Linux Patch Wednesday

Leave a reply

April Linux Patch Wednesday

April Linux Patch Wednesday. Total vulnerabilities: 251. 👌 164 in the Linux Kernel. No vulnerabilities show signs of being exploited in the wild. There are 7 vulnerabilities that appear to have publicly available exploits.

For 2 vulnerabilities, exploit code with detailed explanation is available on GitHub. Both were first patched in RedOS packages:

🔸 SQL injection - Exim (CVE-2025-26794)
🔸 Code Injection - MariaDB (CVE-2023-39593)

For the Memory Corruption - Mozilla Firefox (CVE-2025-3028), the NVD states the exploit code is in Mozilla’s bug tracker, but access is restricted. 🤷‍♂️

BDU FSTEC reports public exploits for 4 vulnerabilities:

🔸 Information Disclosure - GLPI (CVE-2025-21626)
🔸 Security Feature Bypass - GLPI (CVE-2025-23024)
🔸 Denial of Service / Remote Code Execution - Perl (CVE-2024-56406)
🔸 Memory Corruption - Libsoup (CVE-2025-32050)

🗒 Full Vulristics report

На русском

March Linux Patch Wednesday

Leave a reply

March Linux Patch Wednesday

March Linux Patch Wednesday. Total vulnerabilities: 1083. 😱 879 in the Linux Kernel. 🤦‍♂️ Two vulnerabilities show signs of exploitation in the wild:

🔻 Code Injection - GLPI (CVE-2022-35914). An old vulnerability from CISA KEV, but first patched on March 3 in RedOS Linux.
🔻 Memory Corruption - Safari (CVE-2025-24201). Fixed in WebKitGTK packages in Linux repositories.

There are 19 vulnerabilities with publicly available exploits. Notable ones:

🔸 Remote Code Execution - Apache Tomcat (CVE-2025-24813)
🔸 Command Injection - SPIP (CVE-2024-8517)
🔸 Memory Corruption - Assimp (CVE-2025-2152)
🔸 Memory Corruption - libxml2 (CVE-2025-27113)

The Elevation of Privilege vulnerability in the Linux Kernel (CVE-2022-49264) has no public exploit yet. However, it resembles well-known PwnKit (CVE-2021-4034).

🗒 Full Vulristics report

На русском

February Linux Patch Wednesday

Leave a reply

February Linux Patch Wednesday

February Linux Patch Wednesday. There are 561 vulnerabilities in total. 338 in Linux Kernel. Formally, there is one vulnerability with a sign of exploitation in the wild: RCE - 7-Zip (CVE-2025-0411). But it is about Windows MoTW and, naturally, is not exploitable on Linux.

There are public exploits for 21 vulnerabilities.

Among them there are 5 Cacti vulnerabilities:

🔸 RCE - Cacti (CVE-2025-24367)
🔸 Command Injection - Cacti (CVE-2025-22604)
🔸 SQLi - Cacti (CVE-2024-54145, CVE-2025-24368)
🔸 Path Traversal - Cacti (CVE-2024-45598)

2 OpenSSH vulnerabilities discovered by Qualys:

🔸 DoS - OpenSSH (CVE-2025-26466)
🔸 Spoofing/MiTM - OpenSSH (CVE-2025-26465)

Of the rest, the most interesting are:

🔸 RCE - Langchain (CVE-2023-39631), Snapcast (CVE-2023-36177), Checkmk (CVE-2024-13723),
🔸 EoP - Linux Kernel (CVE-2024-50066)
🔸 SQLi - PostgreSQL (CVE-2025-1094)
🔸 XSS - Checkmk (CVE-2024-13722), Thunderbird (CVE-2025-1015)

🗒 Full Vulristics report

На русском

January Linux Patch Wednesday

Leave a reply

January Linux Patch Wednesday

January Linux Patch Wednesday. Out of 424 total vulnerabilities, 271 are in the Linux Kernel. None show signs of exploitation in the wild, but 9 have public exploits.

🔸 RCE - Apache Tomcat (CVE-2024-56337). Based on the description, the vulnerability affects "case-insensitive file systems" like Windows or MacOS. However, Debian lists it as affecting tomcat9 and tomcat10. Either this is about rare case-insensitive Linux installations or there is an error in the description. 🤷‍♂️
🔸 RCE - Chromium (CVE-2025-0291). According to the FSTEC BDU, a public exploit exists.
🔸 RCE - 7-Zip (CVE-2024-11477). What's in the public is not an exploit, but a write-up.
🔸 Memory Corruption - Theora (CVE-2024-56431). It's not clear yet how to exploit this. 🤷‍♂️
🔸 Memory Corruption - Telegram (CVE-2021-31320, CVE-2021-31319, CVE-2021-31315, CVE-2021-31318, CVE-2021-31322). Ubuntu fixed these vulnerabilities in the rlottie library package.

🗒 Full Vulristics report

На русском

December Linux Patch Wednesday

Leave a reply

December Linux Patch Wednesday

December Linux Patch Wednesday. There are 316 vulnerabilities in total. Compared to November LPW - much better. 🙂 119 are in Linux Kernel.

Two vulnerabilities with signs of exploitation in the wild. Both in Safari:

🔻 RCE - Safari (CVE-2024-44308)
🔻 XSS - Safari (CVE-2024-44309)

These vulnerabilities are fixed not in Safari, but in packages of the WebKit browser engine.

There are no signs of exploitation in the wild for 19 vulnerabilities yet, but there are public exploits. The following can be highlighted:

🔸 RCE - Moodle (CVE-2024-43425). First fix in the Linux vendor repository appeared on 2024-11-21 (RedOS)
🔸 Command Injection - Grafana (CVE-2024-9264)
🔸 Command Injection - virtualenv (CVE-2024-53899)
🔸 SQLi - Zabbix (CVE-2024-42327)
🔸 Data Leakage - Apache Tomcat (CVE-2024-52317)

🗒 Vulristics December Linux Patch Wednesday Report

🎉🆕 I released Vulristics 1.0.9 with improved detection of vulnerable software based on CVE description.

На русском