ISHACK AI BOT

Debian: CVE-2025-21692: linux -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/10/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <[email protected]> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441]<TASK> [ 18.858227]dump_stack_lvl+0xc2/0xf0 [ 18.859607]dump_stack+0x10/0x20 [ 18.860908]__ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022]ets_class_change+0x3d6/0x3f0 [ 18.864322]tc_ctl_tclass+0x251/0x910 [ 18.864587]? lock_acquire+0x5e/0x140 [ 18.865113]? __mutex_lock+0x9c/0xe70 [ 18.866009]? __mutex_lock+0xa34/0xe70 [ 18.866401]rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806]? __lock_acquire+0x578/0xc10 [ 18.867184]? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503]netlink_rcv_skb+0x59/0x110 [ 18.867776]rtnetlink_rcv+0x15/0x30 [ 18.868159]netlink_unicast+0x1c3/0x2b0 [ 18.868440]netlink_sendmsg+0x239/0x4b0 [ 18.868721]____sys_sendmsg+0x3e2/0x410 [ 18.869012]___sys_sendmsg+0x88/0xe0 [ 18.869276]? rseq_ip_fixup+0x198/0x260 [ 18.869563]? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900]? trace_hardirqs_off+0x5a/0xd0 [ 18.870196]? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547]? do_syscall_64+0x93/0x150 [ 18.870821]? __memcg_slab_free_hook+0x69/0x290 [ 18.871157]__sys_sendmsg+0x69/0xd0 [ 18.871416]__x64_sys_sendmsg+0x1d/0x30 [ 18.871699]x64_sys_call+0x9e2/0x2670 [ 18.871979]do_syscall_64+0x87/0x150 [ 18.873280]? do_syscall_64+0x93/0x150 [ 18.874742]? lock_release+0x7b/0x160 [ 18.876157]? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833]? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608]? irqentry_exit+0x77/0xb0 [ 18.879808]? clear_bhb_loop+0x15/0x70 [ 18.880023]? clear_bhb_loop+0x15/0x70 [ 18.880223]? clear_bhb_loop+0x15/0x70 [ 18.880426]entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395]</TASK> [ 18.888610] ---[ end trace ]--- Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2025-21692 CVE - 2025-21692

Debian: CVE-2025-21690: linux -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/10/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooting from the VM side. Ratelimit the warning so it doesn't DoS the VM. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2025-21690 CVE - 2025-21690

Debian: CVE-2025-21688: linux -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/10/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL after job completion"), we introduced a change to assign the job pointer to NULL after completing a job, indicating job completion. However, this approach created a race condition between the DRM scheduler workqueue and the IRQ execution thread. As soon as the fence is signaled in the IRQ execution thread, a new job starts to be executed. This results in a race condition where the IRQ execution thread sets the job pointer to NULL simultaneously as the `run_job()` function assigns a new job to the pointer. This race condition can lead to a NULL pointer dereference if the IRQ execution thread sets the job pointer to NULL after `run_job()` assigns it to the new job. When the new job completes and the GPU emits an interrupt, `v3d_irq()` is triggered, potentially causing a crash. [466.310099] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0 [466.318928] Mem abort info: [466.321723] ESR = 0x0000000096000005 [466.325479] EC = 0x25: DABT (current EL), IL = 32 bits [466.330807] SET = 0, FnV = 0 [466.333864] EA = 0, S1PTW = 0 [466.337010] FSC = 0x05: level 1 translation fault [466.341900] Data abort info: [466.344783] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [466.350285] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [466.355350] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [466.360677] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000089772000 [466.367140] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [466.375875] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [466.382163] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep binfmt_misc vc4 snd_soc_hdmi_codec drm_display_helper cec brcmfmac_wcc spidev rpivid_hevc(C) drm_client_lib brcmfmac hci_uart drm_dma_helper pisp_be btbcm brcmutil snd_soc_core aes_ce_blk v4l2_mem2mem bluetooth aes_ce_cipher snd_compress videobuf2_dma_contig ghash_ce cfg80211 gf128mul snd_pcm_dmaengine videobuf2_memops ecdh_generic sha2_ce ecc videobuf2_v4l2 snd_pcm v3d sha256_arm64 rfkill videodev snd_timer sha1_ce libaes gpu_sched snd videobuf2_common sha1_generic drm_shmem_helper mc rp1_pio drm_kms_helper raspberrypi_hwmon spi_bcm2835 gpio_keys i2c_brcmstb rp1 raspberrypi_gpiomem rp1_mailbox rp1_adc nvmem_rmem uio_pdrv_genirq uio i2c_dev drm ledtrig_pattern drm_panel_orientation_quirks backlight fuse dm_mod ip_tables x_tables ipv6 [466.458429] CPU: 0 UID: 1000 PID: 2008 Comm: chromium Tainted: G C 6.13.0-v8+ #18 [466.467336] Tainted: [C]=CRAP [466.470306] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) [466.476157] pstate: 404000c9 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [466.483143] pc : v3d_irq+0x118/0x2e0 [v3d] [466.487258] lr : __handle_irq_event_percpu+0x60/0x228 [466.492327] sp : ffffffc080003ea0 [466.495646] x29: ffffffc080003ea0 x28: ffffff80c0c94200 x27: 0000000000000000 [466.502807] x26: ffffffd08dd81d7b x25: ffffff80c0c94200 x24: ffffff8003bdc200 [466.509969] x23: 0000000000000001 x22: 00000000000000a7 x21: 0000000000000000 [466.517130] x20: ffffff8041bb0000 x19: 0000000000000001 x18: 0000000000000000 [466.524291] x17: ffffffafadfb0000 x16: ffffffc080000000 x15: 0000000000000000 [466.531452] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [466.538613] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffd08c527eb0 [466.545777] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 [466.552941] x5 : ffffffd08c4100d0 x4 : ffffffafadfb0000 x3 : ffffffc080003f70 [466.560102] x2 : ffffffc0829e8058 x1 : 0000000000000001 x0 : 0000000000000000 [466.567263] Call trace: [466.569711]v3d_irq+0x118/0x2e0 [v3d] (P) [466. ---truncated--- Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2025-21688 CVE - 2025-21688

Debian: CVE-2025-24032: pam-pkcs11 -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/10/2025 Created 02/15/2025 Added 02/14/2025 Modified 02/14/2025 Description PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to none (the default value), then pam_pkcs11 will only check if the user is capable of logging into the token. An attacker may create a different token with the user's public data (e.g. the user's certificate) and a PIN known to the attacker. If no signature with the private key is required, then the attacker may now login as user with that created token. The default to *not* check the private key's signature has been changed with commit commi6638576892b59a99389043c90a1e7dd4d783b921, so that all versions starting with pam_pkcs11-0.6.0 should be affected. As a workaround, in `pam_pkcs11.conf`, set at least `cert_policy = signature;`. Solution(s) debian-upgrade-pam-pkcs11 References https://attackerkb.com/topics/cve-2025-24032 CVE - 2025-24032 DSA-5864-1

Debian: CVE-2024-57949: linux -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/09/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/14/2025 Description In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() The following call-chain leads to enabling interrupts in a nested interrupt disabled section: irq_set_vcpu_affinity() irq_get_desc_lock() raw_spin_lock_irqsave() <--- Disable interrupts its_irq_set_vcpu_affinity() guard(raw_spinlock_irq) <--- Enables interrupts when leaving the guard() irq_put_desc_unlock()<--- Warns because interrupts are enabled This was broken in commit b97e8a2f7130, which replaced the original raw_spin_[un]lock() pair with guard(raw_spinlock_irq). Fix the issue by using guard(raw_spinlock). [ tglx: Massaged change log ] Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2024-57949 CVE - 2024-57949

Debian: CVE-2024-12133: libtasn1-6 -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/10/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack. Solution(s) debian-upgrade-libtasn1-6 References https://attackerkb.com/topics/cve-2024-12133 CVE - 2024-12133 DSA-5863-1

Microsoft Edge Chromium: CVE-2025-21279 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/07/2025 Created 02/11/2025 Added 02/07/2025 Modified 02/14/2025 Description Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Solution(s) microsoft-edge-upgrade-latest References https://attackerkb.com/topics/cve-2025-21279 CVE - 2025-21279 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21279

Microsoft Edge Chromium: CVE-2025-21404 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/07/2025 Created 02/11/2025 Added 02/07/2025 Modified 02/10/2025 Description Microsoft Edge (Chromium-based) Spoofing Vulnerability Solution(s) microsoft-edge-upgrade-latest References https://attackerkb.com/topics/cve-2025-21404 CVE - 2025-21404 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21404

Microsoft Edge Chromium: CVE-2025-21283 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/07/2025 Created 02/11/2025 Added 02/07/2025 Modified 02/14/2025 Description Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Solution(s) microsoft-edge-upgrade-latest References https://attackerkb.com/topics/cve-2025-21283 CVE - 2025-21283 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21283

SUSE: CVE-2025-24366: SUSE Linux Security Advisory Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/07/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability. Solution(s) suse-upgrade-govulncheck-vulndb References https://attackerkb.com/topics/cve-2025-24366 CVE - 2025-24366

Microsoft Edge Chromium: CVE-2025-21342 Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 02/07/2025 Created 02/11/2025 Added 02/07/2025 Modified 02/10/2025 Description Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Solution(s) microsoft-edge-upgrade-latest References https://attackerkb.com/topics/cve-2025-21342 CVE - 2025-21342 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21342

Ivanti Pulse Connect Secure: February Security Advisory Ivanti Connect Secure (ICS),Ivanti Policy Secure (IPS) and Ivanti Secure Access Client (ISAC) (Multiple CVEs) Severity 6 CVSS (AV:N/AC:M/Au:N/C:P/I:P/A:N) Published 02/11/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required. Solution(s) pulse-secure-pulse-connect-secure-upgrade-22_7r2_6 References https://attackerkb.com/topics/cve-2024-13830 CVE - 2024-13830 https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US

Microsoft Windows: CVE-2025-21406: Windows Telephony Service Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21406: Windows Telephony Service Remote Code Execution Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21406 CVE - 2025-21406 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Microsoft Windows: CVE-2025-21200: Windows Telephony Service Remote Code Execution Vulnerability Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21200: Windows Telephony Service Remote Code Execution Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21200 CVE - 2025-21200 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Microsoft Windows: CVE-2025-21367: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Severity 6 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21367: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21367 CVE - 2025-21367 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 View more

Microsoft Windows: CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Severity 7 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21181 CVE - 2025-21181 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Adobe Illustrator: CVE-2025-21160: Security updates available for Adobe Illustrator (APSB25-11) Severity 7 CVSS (AV:L/AC:L/Au:N/C:C/I:C/A:C) Published 02/11/2025 Created 02/14/2025 Added 02/12/2025 Modified 02/12/2025 Description Adobe has released an update for Adobe Illustrator. This update resolves critical vulnerabilities that could lead to arbitrary code execution. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Solution(s) adobe-illustrator-upgrade-latest References https://attackerkb.com/topics/cve-2025-21160 CVE - 2025-21160 https://helpx.adobe.com/security/products/illustrator/apsb25-11.html

Ivanti Pulse Connect Secure: February Security Advisory Ivanti Connect Secure (ICS),Ivanti Policy Secure (IPS) and Ivanti Secure Access Client (ISAC) (Multiple CVEs) Severity 4 CVSS (AV:L/AC:L/Au:M/C:C/I:N/A:N) Published 02/11/2025 Created 02/13/2025 Added 02/12/2025 Modified 02/12/2025 Description A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local unauthenticated attacker to read sensitive data. Solution(s) pulse-secure-pulse-connect-secure-upgrade-22_7r2_3 References https://attackerkb.com/topics/cve-2024-13842 CVE - 2024-13842 https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US

Microsoft Windows: CVE-2025-21350: Windows Kerberos Denial of Service Vulnerability Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21350: Windows Kerberos Denial of Service Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21350 CVE - 2025-21350 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Microsoft Windows: CVE-2025-21212: Internet Connection Sharing (ICS) Denial of Service Vulnerability Severity 6 CVSS (AV:A/AC:L/Au:N/C:N/I:N/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21212: Internet Connection Sharing (ICS) Denial of Service Vulnerability Solution(s) microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21212 CVE - 2025-21212 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 View more

Adobe Illustrator: CVE-2025-21159: Security updates available for Adobe Illustrator (APSB25-11) Severity 7 CVSS (AV:L/AC:L/Au:N/C:C/I:C/A:C) Published 02/11/2025 Created 02/14/2025 Added 02/12/2025 Modified 02/12/2025 Description Adobe has released an update for Adobe Illustrator. This update resolves critical vulnerabilities that could lead to arbitrary code execution. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. Solution(s) adobe-illustrator-upgrade-latest References https://attackerkb.com/topics/cve-2025-21159 CVE - 2025-21159 https://helpx.adobe.com/security/products/illustrator/apsb25-11.html

Microsoft Windows: CVE-2025-21182: Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability Severity 6 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21182: Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21182 CVE - 2025-21182 https://support.microsoft.com/help/5051987

Microsoft Windows: CVE-2025-21373: Windows Installer Elevation of Privilege Vulnerability Severity 6 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21373: Windows Installer Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21373 CVE - 2025-21373 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Microsoft Windows: CVE-2025-21375: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability Severity 6 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21375: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21375 CVE - 2025-21375 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more

Microsoft Windows: CVE-2025-21419: Windows Setup Files Cleanup Elevation of Privilege Vulnerability Severity 6 CVSS (AV:L/AC:L/Au:S/C:N/I:C/A:C) Published 02/11/2025 Created 02/12/2025 Added 02/11/2025 Modified 02/11/2025 Description Microsoft Windows: CVE-2025-21419: Windows Setup Files Cleanup Elevation of Privilege Vulnerability Solution(s) microsoft-windows-windows_10-1507-kb5052040 microsoft-windows-windows_10-1607-kb5052006 microsoft-windows-windows_10-1809-kb5052000 microsoft-windows-windows_10-21h2-kb5051974 microsoft-windows-windows_10-22h2-kb5051974 microsoft-windows-windows_11-22h2-kb5051989 microsoft-windows-windows_11-23h2-kb5051989 microsoft-windows-windows_11-24h2-kb5051987 microsoft-windows-windows_server_2012-kb5052020 microsoft-windows-windows_server_2012_r2-kb5052042 microsoft-windows-windows_server_2016-1607-kb5052006 microsoft-windows-windows_server_2019-1809-kb5052000 microsoft-windows-windows_server_2022-21h2-kb5051979 microsoft-windows-windows_server_2022-22h2-kb5051979 microsoft-windows-windows_server_2022-23h2-kb5051980 microsoft-windows-windows_server_2025-24h2-kb5051987 References https://attackerkb.com/topics/cve-2025-21419 CVE - 2025-21419 https://support.microsoft.com/help/5051974 https://support.microsoft.com/help/5051979 https://support.microsoft.com/help/5051980 https://support.microsoft.com/help/5051987 https://support.microsoft.com/help/5051989 https://support.microsoft.com/help/5052000 https://support.microsoft.com/help/5052006 https://support.microsoft.com/help/5052020 https://support.microsoft.com/help/5052040 https://support.microsoft.com/help/5052042 View more