Security Patches and News

posted by Roy Schestowitz on Dec 11, 2025

• • Possible exploit variant for CVE-2024-9042 (Kubernetes OS Command Injection), (Wed, Dec 10th)

    Last year, Kubernetes fixed a command injection vulnerability in the Kubernetes NodeLogQuery feature...

  • Security updates for Wednesday

    Security updates have been issued by AlmaLinux (abrt and kernel), Debian (libpng1.6, libsoup2.4, pdns-recursor, webkit2gtk, and wordpress), Fedora (imhex, libwebsockets, lunasvg, python3-docs, and python3.14), Mageia (python3 and webkit2), Red Hat (abrt, firefox, mysql8.4, and postgresql:15), Slackware (mozilla), SUSE (gegl, gnutls, go1.24, go1.25, libpng16-16, openssh, postgresql13, python-Jinja2, and sssd), and Ubuntu (fonttools and netty).

  • Kroah-Hartman: Linux CVEs, more than you ever wanted to know

    Greg Kroah-Hartman is writing a series of blog posts about Linux becoming a Certificate Numbering Authority (CNA): [...]

  • smb4k: Major Vulnerabilities in KAuth Helper (CVE-2025-66002, CVE-2025-66003)

    smb4k is a KDE desktop related utility which allows unprivileged mounting of Samba/CIFS network shares. The SUSE security team reviewed its privileged KAuth helper component already in 2017 which led to the discovery of CVE-2017-8422 (general KAuth authentication bypass) and CVE-2017-8849 (local root exploit via smb4k mount helper).

  • Qubes Canary 045

    We have published Qubes Canary 045. The text of this canary and its accompanying cryptographic signatures are reproduced below. For an explanation of this announcement and instructions for authenticating this canary, please see the end of this announcement.

  • Google Patches Gemini Enterprise Vulnerability Exposing Corporate Data

    GeminiJack is a zero-click Gemini attack that could have been exploited using specially crafted emails, calendar invites, or documents.