govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16044 Final 1 1 2025-04-10T00:00:00Z current 2025-04-10T00:00:00Z 2025-04-10T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250409T170536-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16044 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-31483/ SUSE CVE CVE-2025-31483 page https://www.suse.com/security/cve/CVE-2025-31489/ SUSE CVE CVE-2025-31489 page https://www.suse.com/security/cve/CVE-2025-32024/ SUSE CVE CVE-2025-32024 page https://www.suse.com/security/cve/CVE-2025-32025/ SUSE CVE CVE-2025-32025 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250409T170536-1.1 govulncheck-vulndb-0.0.20250409T170536-1.1 as a component of openSUSE Tumbleweed Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7. CVE-2025-31483 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-31483.html CVE-2025-31483 MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z. CVE-2025-31489 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-31489.html CVE-2025-31489 bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The EXIF data format allows for defining excessively large data structures in relatively small payloads. Before v0.10.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.10.0 added LimitNumTags (default 5000) and LimitTagSize (default 10000) options. CVE-2025-32024 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-32024.html CVE-2025-32024 https://bugzilla.suse.com/1240992 SUSE Bug 1240992 bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit. CVE-2025-32025 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250409T170536-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-32025.html CVE-2025-32025 https://bugzilla.suse.com/1240993 SUSE Bug 1240993