patch management

Oracle’s MySQL Server was assigned CVE‑2024‑20969 — a medium‑severity flaw in the Server: DDL component that lets an attacker with already high‑privilege network access cause sustained outages and limited data modification in affected releases, and operators must treat it as an urgent...

A stack‑overflow bug in the widely used asynchronous DNS library c‑ares — tracked as CVE‑2022‑4904 — allows unbounded input to overflow a local stack buffer during sortlist parsing, creating a denial‑of‑service condition and a limited confidentiality/integrity exposure; the defect was fixed...

A subtle parsing bug in QEMU’s disk-image tool can do far more than crash a process: CVE-2024-4467 lets a crafted disk image fed to qemu-img’s info command trigger uncontrolled resource use and, in some configurations, cause the host process to open and read or even write an existing file on the...

The Linux kernel vulnerability tracked as CVE-2023-52340 exposes a subtle but powerful availability risk: a flaw in the IPv6 route-caching logic can be driven into a denial-of-service condition by repeated IPv6 traffic patterns (for example, packets sent in a loop from a raw socket or floods of...

The Linux kernel received a targeted fix this summer for a subtle but real availability bug in the Video for Linux (V4L) asynchronous notifier code: notifier list entries were not being re‑initialised after unregister, leaving dangling list pointers that can crash the kernel and produce a local...

An encoding flaw in Apache HTTP Server’s mod_proxy can let crafted requests slip past intended authentication checks and reach backend services, potentially exposing protected resources — operators should treat this as an urgent configuration and patch-management issue and update affected...

The Linux kernel fix addressing CVE-2024-39476 — a deadlock in the md/raid5 subsystem where raid5d() could wait for itself to clear MD_SB_CHANGE_PENDING — is an important stability patch that has rippled through distributions and cloud images. Microsoft’s public guidance has confirmed that Azure...

A deep parsing bug in polkit’s XML policy handler can be triggered by a crafted .policy file with unusually deep nesting (32 or more elements), producing an out‑of‑bounds write that can crash polkit’s daemon and — in the worst case — might be leveraged toward code execution; vendors and upstream...

A denial‑of‑service flaw in Oracle’s MySQL Server (tracked as CVE‑2025‑50101) lets an attacker who already holds high‑privilege MySQL credentials trigger optimizer and stored‑procedure code paths that cause mysqld to hang or crash repeatedly, producing a sustained or persistent loss of...

The Linux kernel fix tracked as CVE-2025-38158 addresses a subtle but consequential DMA address assembly bug in the Hisilicon VFIO accelerator driver (hisi_acc_vfio_pci) that can leave guest kernel‑mode encryption services broken after live migration — and Microsoft’s short MSRC attestation that...

The Linux kernel patch that closed CVE-2025-38111 — a bounds‑check defect in net/mdiobus — is small in code but large in operational impact: it removes a user‑supplied MDIO address from an unchecked ioctl path that could be used to read or write beyond the kernel’s mdiobus statistics array, and...

The PHP pgsql extension’s escaping logic failed a simple but critical safety check: it didn't always verify whether the PostgreSQL client library reported an error when escaping identifiers and strings. The result, tracked as CVE-2025-1735, is an availability- and stability-focused vulnerability...

Redis users should treat this as urgent: a newly disclosed vulnerability in HyperLogLog handling can be triggered by an authenticated client to cause stack or heap out-of-bounds writes — and those memory corruptions can be turned into remote code execution or persistent service loss if left...

Oracle’s July 2025 Critical Patch Update included a MySQL Server vulnerability tracked as CVE-2025-50079 that can be triggered over the network by a high‑privilege account and cause the server process to hang or crash repeatedly, producing a denial‑of‑service (DoS) condition for affected MySQL...

Oracle’s July 15, 2025 advisory that introduced CVE-2025-50096 describes a denial‑of‑service weakness in MySQL Server’s InnoDB component that can be triggered by a high‑privilege actor with network access, and — when exploited — can hang or repeatedly crash mysqld, producing sustained or...

A denial-of-service flaw in Oracle MySQL Server’s InnoDB engine—tracked as CVE-2025-50099—was disclosed in July 2025 and affects widely deployed MySQL release lines. The vulnerability can be triggered by an attacker with high privileges and network access and may cause the server process to hang...

A newly disclosed denial‑of‑service vulnerability in Oracle’s MySQL Server — tracked as CVE‑2025‑50080 — affects a broad range of MySQL releases and can cause sustained or persistent loss of availability by triggering hangs or repeated crashes in the server’s stored‑procedure handling code. The...

A subtle sequence of PHP internals — an exception triggered inside a magic property setter combined with a null‑coalescing assignment — can produce a use‑after‑free in the engine’s shutdown path, leaving unpatched PHP 8.3 and 8.4 builds exposed to high‑impact crashes and, in some scenarios, the...

Libsoup’s URI decoder can be crashed by a malformed data: URI, creating a remotely triggerable denial‑of‑service that administrators and application developers must treat as an operational risk rather than a low‑importance parsing bug. Background / Overview Libsoup is the widely used HTTP...

A subtle null‑check omission in the Linux kernel’s AMD display driver has been cataloged as CVE‑2025‑21941 and patched upstream; the bug is a local null‑pointer dereference in drm/amd/display’s resource_build_scaling_params that can crash the kernel and produce a denial‑of‑service condition on...