Security Leftovers

posted by Roy Schestowitz on Apr 10, 2025

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by AlmaLinux (gimp, libxslt, python3.11, python3.12, and tomcat), Debian (ghostscript and libnet-easytcp-perl), Fedora (openvpn, perl-Data-Entropy, and webkitgtk), Red Hat (python-jinja2), SUSE (giflib, pam, and xen), and Ubuntu (apache2, binutils, expat, fis-gtm, linux-azure, linux-azure-6.8, linux-nvidia-lowlatency, linux-azure, linux-azure-fde, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-gcp-fips, linux-hwe-5.4, linux-nvidia, linux-nvidia-tegra-igx, ruby2.7, ruby3.0, ruby3.2, ruby3.3, and vim).

• Security Week ☛ Adobe Calls Urgent Attention to Critical ColdFusion Flaws

  The Adobe Patch Tuesday rollout covers 54 vulnerabilities, including code execution issues in the oft-targeted Adobe ColdFusion software.

• Security Week ☛ DNS: The Secret Weapon CISOs May Be Overlooking in the Fight Against Cyberattacks

  While often relegated to a purely functional role, DNS offers unparalleled opportunities for preemptive defense against cyberattacks.

• Security Week ☛ SAP Patches Critical Code Injection Vulnerabilities

  SAP released 20 security notes on April 2025 patch day, including three addressing critical code injection and authentication bypass flaws.

• Security Week ☛ WhatsApp Vulnerability Could Facilitate Remote Code Execution

  An update for the WhatsApp desktop app for backdoored Windows patches CVE-2025-30401, a spoofing vulnerability that could be used to trick users.

• Fedora / IBM

  • LWN ☛ Fedora change aims for 99% package reproducibility

    The effort to ensure that open-source software is reproducible has been gathering steam over the years, and gaining traction with major Linux distributions. Debian, for example, has been working toward reproducible builds for more than a decade; it can now produce official live CDs of the current stable release that are reproducible. Fedora started on the path much later, but it has progressed far enough that the project is now considering a change proposal for the Fedora 43 development cycle, expected to be released in October, with a goal of making 99% of Fedora's package builds reproducible. So far, reaction to the proposal seems favorable and focused primarily on how to achieve the goal—with minimal pain for packagers—rather than whether to attempt it.