Security Warnings — Week: 2025-W15

ksmbd: validate zero num_subauth before sub_auth is accessed

2025-04-08 CVE-2025-22038

highMicrosoft MSRC 2025-W15

Libsoup: cookie domain validation bypass via uppercase characters in libsoup

2025-04-08 CVE-2025-4035

mediumMicrosoft MSRC 2025-W15

Libsoup: denial of service attack to websocket server

2025-04-08 CVE-2025-32049

highMicrosoft MSRC 2025-W15

Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header

2025-04-08 CVE-2025-32907

mediumMicrosoft MSRC 2025-W15

Libsoup: denial of service on libsoup through http/2 server

2025-04-08 CVE-2025-32908

highMicrosoft MSRC 2025-W15

Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value

2025-04-08 CVE-2025-32911

criticalMicrosoft MSRC 2025-W15

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

2025-04-08 CVE-2025-2784

highMicrosoft MSRC 2025-W15

Libsoup: heap buffer overflow in sniff_unknown()

2025-04-08 CVE-2025-32052

mediumMicrosoft MSRC 2025-W15

Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()

2025-04-08 CVE-2025-32053

mediumMicrosoft MSRC 2025-W15

Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server

2025-04-08 CVE-2025-46421

mediumMicrosoft MSRC 2025-W15

Libsoup: integer overflow in append_param_quoted

2025-04-08 CVE-2025-32050

mediumMicrosoft MSRC 2025-W15

Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c

2025-04-08 CVE-2025-46420

mediumMicrosoft MSRC 2025-W15

Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized

2025-04-08 CVE-2025-32910

mediumMicrosoft MSRC 2025-W15

Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication

2025-04-08 CVE-2025-32912

mediumMicrosoft MSRC 2025-W15

Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header

2025-04-08 CVE-2025-32913

highMicrosoft MSRC 2025-W15

Libsoup: null pointer dereference on libsoup through function "sniff_mp4" in soup-content-sniffer.c

2025-04-08 CVE-2025-32909

mediumMicrosoft MSRC 2025-W15

Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process

2025-04-08 CVE-2025-32914

highMicrosoft MSRC 2025-W15

Libsoup: out of bounds reads in soup_headers_parse_request()

2025-04-08 CVE-2025-32906

highMicrosoft MSRC 2025-W15

Libsoup: segmentation fault when parsing malformed data uri

2025-04-08 CVE-2025-32051

mediumMicrosoft MSRC 2025-W15

Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability

2025-04-08 CVE-2025-26670

highMicrosoft MSRC 2025-W15

LoongArch: BPF: Fix off-by-one error in build_prologue()

2025-04-08 CVE-2025-37893

mediumMicrosoft MSRC 2025-W15

LoongArch: Increase ARCH_DMA_MINALIGN up to 16

2025-04-08 CVE-2025-22049

mediumMicrosoft MSRC 2025-W15

LoongArch: Set hugetlb mmap base address aligned with pmd size

2025-04-08 CVE-2025-21949

mediumMicrosoft MSRC 2025-W15

md: fix mddev uaf while iterating all_mddevs list

2025-04-08 CVE-2025-22126

highMicrosoft MSRC 2025-W15

md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

2025-04-08 CVE-2025-22124

mediumMicrosoft MSRC 2025-W15

md/raid1,raid10: don't ignore IO flags

2025-04-08 CVE-2025-22125

mediumMicrosoft MSRC 2025-W15

md/raid10: wait barrier before returning discard request with REQ_NOWAIT

2025-04-08 CVE-2025-40325

lowMicrosoft MSRC 2025-W15

media: streamzap: fix race between device disconnection and urb callback

2025-04-08 CVE-2025-22027

mediumMicrosoft MSRC 2025-W15

media: vimc: skip .s_stream() for stopped entities

2025-04-08 CVE-2025-22028

mediumMicrosoft MSRC 2025-W15

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

2025-04-08 CVE-2025-22020

highMicrosoft MSRC 2025-W15

Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-29800

highMicrosoft MSRC 2025-W15

Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-29801

highMicrosoft MSRC 2025-W15

Microsoft DWM Core Library Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-24060

highMicrosoft MSRC 2025-W15

Microsoft DWM Core Library Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-24062

highMicrosoft MSRC 2025-W15

Microsoft DWM Core Library Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-24073

highMicrosoft MSRC 2025-W15

Microsoft DWM Core Library Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-24074

highMicrosoft MSRC 2025-W15

Microsoft Dynamics Business Central Information Disclosure Vulnerability

2025-04-08 CVE-2025-29821

mediumMicrosoft MSRC 2025-W15

Microsoft Dynamics Information Disclosure Vulnerability

2025-04-08 CVE-2025-30391

highMicrosoft MSRC 2025-W15

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

2025-04-08 CVE-2025-25000

highMicrosoft MSRC 2025-W15

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

2025-04-08 CVE-2025-29815

highMicrosoft MSRC 2025-W15

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

2025-04-08 CVE-2025-29834

highMicrosoft MSRC 2025-W15

Microsoft Edge for iOS Spoofing Vulnerability

2025-04-08 CVE-2025-25001

mediumMicrosoft MSRC 2025-W15

Microsoft Edge for iOS Spoofing Vulnerability

2025-04-08 CVE-2025-29796

mediumMicrosoft MSRC 2025-W15

Microsoft Excel Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27750

highMicrosoft MSRC 2025-W15

Microsoft Excel Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27751

highMicrosoft MSRC 2025-W15

Microsoft Excel Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27752

highMicrosoft MSRC 2025-W15

Microsoft Excel Remote Code Execution Vulnerability

2025-04-08 CVE-2025-29791

highMicrosoft MSRC 2025-W15

Microsoft Excel Remote Code Execution Vulnerability

2025-04-08 CVE-2025-29823

highMicrosoft MSRC 2025-W15

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

2025-04-08 CVE-2025-26641

highMicrosoft MSRC 2025-W15

Microsoft Office Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-27744

highMicrosoft MSRC 2025-W15

Microsoft Office Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-29792

highMicrosoft MSRC 2025-W15

Microsoft Office Remote Code Execution Vulnerability

2025-04-08 CVE-2025-26642

highMicrosoft MSRC 2025-W15

Microsoft Office Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27745

highMicrosoft MSRC 2025-W15

Microsoft Office Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27746

highMicrosoft MSRC 2025-W15

Microsoft Office Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27748

highMicrosoft MSRC 2025-W15

Microsoft Office Remote Code Execution Vulnerability

2025-04-08 CVE-2025-27749

highMicrosoft MSRC 2025-W15

Microsoft OneNote Security Feature Bypass Vulnerability

2025-04-08 CVE-2025-29822

highMicrosoft MSRC 2025-W15

Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability

2025-04-08 CVE-2025-27731

highMicrosoft MSRC 2025-W15

Microsoft Power Automate Desktop Information Disclosure Vulnerability

2025-04-08 CVE-2025-29817

mediumMicrosoft MSRC 2025-W15

Microsoft SharePoint Remote Code Execution Vulnerability

2025-04-08 CVE-2025-29793

highMicrosoft MSRC 2025-W15