Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
203
security advisorybuffer overflowimportantMageia 9: libavif Important Buffer Overflow Advisory MGASA-2025-0257
MGASA-2025-0257 - Updated libavif packages fix security vulnerabilities. MGASA-2025-0257 - Updated libavif packages fix security vulnerabilities Publication date: 04 Nov 2025 URL: https://advisories.mageia.org/MGASA-2025-0257.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-48174, CVE-2025-48175 Description: In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream-> offset+size. (CVE-2025-48174) In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (CVE-2025-48175) References: - https://bugs.mageia.org/show_bug.cgi?id=34336 - https://lists.debian.org/debian-security-announce/2025/msg00094.html - https://www.cve.org/CVERecord?id=CVE-2025-48174 - https://www.cve.org/CVERecord?id=CVE-2025-48175 SRPMS: - 9/core/libavif-0.11.1-1.1.mga9 . Mageia 9 libavif security update addresses important integer and buffer overflow issues; patches available now!. Mageia, libavif, security patch, buffer overflow. . Severity: Important. LinuxSecurity.com Team
Nov 04, 2025
•Important
Mageia
202
security advisorybuffer overflowmemory corruptionopenSUSE Leap 15.4: Critical libavif Buffer Overflow Issue 2025:03237-1
An update that solves four vulnerabilities and contains one feature can now be installed.. # Security update for libavif Announcement ID: SUSE-SU-2025:03237-1 Release Date: 2025-09-16T10:05:03Z Rating: important References: * bsc#1217614 * bsc#1217615 * bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: * CVE-2023-6350 * CVE-2023-6351 * CVE-2025-48174 * CVE-2025-48175 CVSS scores: * CVE-2023-6350 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-6351 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-48174 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48174 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48174 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2025-48174 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48175 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48175 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48175 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48175 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 LTS *SUSE Manager Retail Branch Server 4.3 * SUSE Manager Retail Branch Server 4.3 LTS * SUSE Manager Server 4.3 * SUSE Manager Server 4.3 LTS An update that solves four vulnerabilities and contains one feature can now be installed. ## Description: This update for libavif fixes the following issues: Update to 1.3.0: * CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (bsc#1243270) * CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in stream-> offset+size. (bsc#1243269) * CVE-2023-6350: Fixed an out of bounds memory to alphaItemIndices. (bsc#1217614) * CVE-2023-6351: Fixed a use-after-free in colorProperties. (bsc#1217615) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-3237=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-3237=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-3237=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-3237=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-3237=1 * SUSE Manager Proxy 4.3 LTS zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-LTS-2025-3237=1 * SUSE Manager Retail Branch Server 4.3 LTS zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-LTS-2025-3237=1 * SUSE Manager Server 4.3 LTS zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-LTS-2025-3237=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3237=1 ## Package List: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 *libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Proxy 4.3 LTS (x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Retail Branch Server 4.3 LTS (x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Server 4.3 LTS (ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libavif-devel-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * gdk-pixbuf-loader-libavif-debuginfo-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * avif-tools-1.3.0-150400.3.6.1 * gdk-pixbuf-loader-libavif-1.3.0-150400.3.6.1 * avif-tools-debuginfo-1.3.0-150400.3.6.1 * libavif16-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (x86_64) * libavif16-32bit-1.3.0-150400.3.6.1 * libavif16-32bit-debuginfo-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libavif16-64bit-1.3.0-150400.3.6.1 * libavif16-64bit-debuginfo-1.3.0-150400.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6350.html * https://www.suse.com/security/cve/CVE-2023-6351.html * https://www.suse.com/security/cve/CVE-2025-48174.html * https://www.suse.com/security/cve/CVE-2025-48175.html * https://bugzilla.suse.com/show_bug.cgi?id=1217614 * https://bugzilla.suse.com/show_bug.cgi?id=1217615 * https://bugzilla.suse.com/show_bug.cgi?id=1243269 * https://bugzilla.suse.com/show_bug.cgi?id=1243270 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13277&page_caps=&user_role= . SUSE revealed significant upgrades for libavif, addressing various security vulnerabilities and improving overall system reliability.. libavif update, openSUSE security patch, patch instructions, SUSE Linux enhancement. .Severity: Important. LinuxSecurity.com Team
Sep 16, 2025
•Important
OpenSUSE
100
security advisorybuffer overflowSuSESUSE: libavif Important Buffer Integer Overflow Vuln 2025:03237-1
* bsc#1217614 * bsc#1217615 * bsc#1243269 * bsc#1243270 * jsc#PED-13277 . # Security update for libavif Announcement ID: SUSE-SU-2025:03237-1 Release Date: 2025-09-16T10:05:03Z Rating: important References: * bsc#1217614 * bsc#1217615 * bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: * CVE-2023-6350 * CVE-2023-6351 * CVE-2025-48174 * CVE-2025-48175 CVSS scores: * CVE-2023-6350 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-6351 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-48174 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48174 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48174 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2025-48174 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48175 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48175 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48175 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48175 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 LTS * SUSE Manager RetailBranch Server 4.3 * SUSE Manager Retail Branch Server 4.3 LTS * SUSE Manager Server 4.3 * SUSE Manager Server 4.3 LTS An update that solves four vulnerabilities and contains one feature can now be installed. ## Description: This update for libavif fixes the following issues: Update to 1.3.0: * CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (bsc#1243270) * CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in stream-> offset+size. (bsc#1243269) * CVE-2023-6350: Fixed an out of bounds memory to alphaItemIndices. (bsc#1217614) * CVE-2023-6351: Fixed a use-after-free in colorProperties. (bsc#1217615) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-3237=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-3237=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-3237=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-3237=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-3237=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-3237=1 * SUSE Manager Proxy 4.3 LTS zypper in -t patchSUSE-SLE-Product-SUSE-Manager-Proxy-4.3-LTS-2025-3237=1 * SUSE Manager Retail Branch Server 4.3 LTS zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-LTS-2025-3237=1 * SUSE Manager Server 4.3 LTS zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-LTS-2025-3237=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3237=1 ## Package List: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 *libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Proxy 4.3 LTS (x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Retail Branch Server 4.3 LTS (x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * SUSE Manager Server 4.3 LTS (ppc64le s390x x86_64) * libavif16-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libavif-devel-1.3.0-150400.3.6.1 * libavif-debugsource-1.3.0-150400.3.6.1 * gdk-pixbuf-loader-libavif-debuginfo-1.3.0-150400.3.6.1 * libavif16-debuginfo-1.3.0-150400.3.6.1 * avif-tools-1.3.0-150400.3.6.1 * gdk-pixbuf-loader-libavif-1.3.0-150400.3.6.1 * avif-tools-debuginfo-1.3.0-150400.3.6.1 * libavif16-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (x86_64) * libavif16-32bit-1.3.0-150400.3.6.1 * libavif16-32bit-debuginfo-1.3.0-150400.3.6.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libavif16-64bit-1.3.0-150400.3.6.1 * libavif16-64bit-debuginfo-1.3.0-150400.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6350.html * https://www.suse.com/security/cve/CVE-2023-6351.html * https://www.suse.com/security/cve/CVE-2025-48174.html * https://www.suse.com/security/cve/CVE-2025-48175.html * https://bugzilla.suse.com/show_bug.cgi?id=1217614 * https://bugzilla.suse.com/show_bug.cgi?id=1217615 * https://bugzilla.suse.com/show_bug.cgi?id=1243269 * https://bugzilla.suse.com/show_bug.cgi?id=1243270 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13277&page_caps=&user_role= . SUSE releases a critical security patch for libavif, targeting various vulnerabilities that threaten system stability.. libavif update, important alert, performance patch, enterprise security, critical update. . Severity:Important. LinuxSecurity.com Team
Sep 16, 2025
•Important
SuSE
100
security advisorymoderatebuffer overflowSUSE: libavif Moderate Integer Overflow and Buffer Overflow 2025:02816-1
* bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: . # Security update for libavif Announcement ID: SUSE-SU-2025:02816-1 Release Date: 2025-08-15T12:55:49Z Rating: moderate References: * bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: * CVE-2025-48174 * CVE-2025-48175 CVSS scores: * CVE-2025-48174 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48174 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48174 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48174 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2025-48175 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48175 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48175 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2025-48175 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L Affected Products: * Basesystem Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves two vulnerabilities and contains one feature can now be installed. ## Description: This update for libavif fixes the following issues: * update to 1.3.0: * CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (bsc#1243270) * CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in stream-> offset+size. (bsc#1243269) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2025-2816=1 ## Package List: * BasesystemModule 15-SP7 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-1.3.0-150700.3.6.1 * libavif16-1.3.0-150700.3.6.1 * libavif16-debuginfo-1.3.0-150700.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2025-48174.html * https://www.suse.com/security/cve/CVE-2025-48175.html * https://bugzilla.suse.com/show_bug.cgi?id=1243269 * https://bugzilla.suse.com/show_bug.cgi?id=1243270 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13277&page_caps=&user_role= . Debian security patch: libavif addresses significant vulnerabilities identified as CVE-2025-48174 and CVE-2025-48175, safeguarding system reliability.. SUSE Linux, security update, libavif, integer overflow, buffer overflow. . Severity: Important. LinuxSecurity.com Team
Aug 15, 2025
•Important
SuSE
202
security advisorymoderatebuffer overflowopenSUSE Leap 15.6: libavif Moderate Buffer Overflow Issues 2025:02817-1
An update that solves two vulnerabilities and contains one feature can now be installed.. # Security update for libavif Announcement ID: SUSE-SU-2025:02817-1 Release Date: 2025-08-15T12:56:05Z Rating: moderate References: * bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: * CVE-2025-48174 * CVE-2025-48175 CVSS scores: * CVE-2025-48174 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48174 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48174 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48174 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2025-48175 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48175 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48175 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2025-48175 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves two vulnerabilities and contains one feature can now be installed. ## Description: This update for libavif fixes the following issues: * update to 1.3.0: * CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (bsc#1243270) * CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in stream-> offset+size. (bsc#1243269) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-2817=1openSUSE-SLE-15.6-2025-2817=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-2817=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libavif-debugsource-1.3.0-150600.3.5.1 * avif-tools-1.3.0-150600.3.5.1 * libavif-devel-1.3.0-150600.3.5.1 * libavif16-1.3.0-150600.3.5.1 * avif-tools-debuginfo-1.3.0-150600.3.5.1 * gdk-pixbuf-loader-libavif-debuginfo-1.3.0-150600.3.5.1 * gdk-pixbuf-loader-libavif-1.3.0-150600.3.5.1 * libavif16-debuginfo-1.3.0-150600.3.5.1 * openSUSE Leap 15.6 (x86_64) * libavif16-32bit-debuginfo-1.3.0-150600.3.5.1 * libavif16-32bit-1.3.0-150600.3.5.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libavif16-64bit-debuginfo-1.3.0-150600.3.5.1 * libavif16-64bit-1.3.0-150600.3.5.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150600.3.5.1 * libavif16-debuginfo-1.3.0-150600.3.5.1 * libavif-debugsource-1.3.0-150600.3.5.1 ## References: * https://www.suse.com/security/cve/CVE-2025-48174.html * https://www.suse.com/security/cve/CVE-2025-48175.html * https://bugzilla.suse.com/show_bug.cgi?id=1243269 * https://bugzilla.suse.com/show_bug.cgi?id=1243270 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13277&page_caps=&user_role= . Urgent patch release for libavif on openSUSE addressing integer manipulation and buffer overflow vulnerabilities identified and resolved.. openSUSE libavif security update. . LinuxSecurity.com Team
Aug 15, 2025
OpenSUSE
100
security advisorymoderatebuffer overflowSUSE: libwebp Critical Integer Overflow Buffer Flaw CVE-2025:02818-2
* bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: . # Security update for libavif Announcement ID: SUSE-SU-2025:02817-1 Release Date: 2025-08-15T12:56:05Z Rating: moderate References: * bsc#1243269 * bsc#1243270 * jsc#PED-13277 Cross-References: * CVE-2025-48174 * CVE-2025-48175 CVSS scores: * CVE-2025-48174 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48174 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48174 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L * CVE-2025-48174 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2025-48175 ( SUSE ): 7.0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N * CVE-2025-48175 ( SUSE ): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L * CVE-2025-48175 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2025-48175 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves two vulnerabilities and contains one feature can now be installed. ## Description: This update for libavif fixes the following issues: * update to 1.3.0: * CVE-2025-48175: Fixed an integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. (bsc#1243270) * CVE-2025-48174: Fixed an integer overflow and resultant buffer overflow in stream-> offset+size. (bsc#1243269) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-2817=1 openSUSE-SLE-15.6-2025-2817=1 * BasesystemModule 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-2817=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libavif-debugsource-1.3.0-150600.3.5.1 * avif-tools-1.3.0-150600.3.5.1 * libavif-devel-1.3.0-150600.3.5.1 * libavif16-1.3.0-150600.3.5.1 * avif-tools-debuginfo-1.3.0-150600.3.5.1 * gdk-pixbuf-loader-libavif-debuginfo-1.3.0-150600.3.5.1 * gdk-pixbuf-loader-libavif-1.3.0-150600.3.5.1 * libavif16-debuginfo-1.3.0-150600.3.5.1 * openSUSE Leap 15.6 (x86_64) * libavif16-32bit-debuginfo-1.3.0-150600.3.5.1 * libavif16-32bit-1.3.0-150600.3.5.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libavif16-64bit-debuginfo-1.3.0-150600.3.5.1 * libavif16-64bit-1.3.0-150600.3.5.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libavif16-1.3.0-150600.3.5.1 * libavif16-debuginfo-1.3.0-150600.3.5.1 * libavif-debugsource-1.3.0-150600.3.5.1 ## References: * https://www.suse.com/security/cve/CVE-2025-48174.html * https://www.suse.com/security/cve/CVE-2025-48175.html * https://bugzilla.suse.com/show_bug.cgi?id=1243269 * https://bugzilla.suse.com/show_bug.cgi?id=1243270 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13277&page_caps=&user_role= . SUSE releases security patch for libavif targeting moderate risks that involve potential integer overflows and buffer overflows.. SUSE security update, libavif patch, buffer overflow fix, integer overflow issue. . LinuxSecurity.com Team
Aug 15, 2025
SuSE
87
security advisorydenial of servicedebianDebian: DSA-5930-1 critical: libavif denial of service and code execution
Multiple vulnerabilities were discovered in libavif, a library for handling .avif files, which could result in denial of service or potentially the execution of arbitrary code. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5930-1
May 29, 2025
•Critical
Debian
100
security advisorycriticalsoftware patchSUSE: 2024:0423-1 Important: Libavif Use After Free Critical Threat
* bsc#1218303 Cross-References: * CVE-2023-6704 . # Security update for libavif Announcement ID: SUSE-SU-2024:0423-1 Rating: important References: * bsc#1218303 Cross-References: * CVE-2023-6704 CVSS scores: * CVE-2023-6704 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-6704 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for libavif fixes the following issues: * CVE-2023-6704: Fixed use after free by not storing colorproperties until alpha item is found (bsc#1218303). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-423=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-423=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-423=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patchSUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-423=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-423=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-423=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-423=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-423=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-423=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif-devel-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-debuginfo-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * avif-tools-debuginfo-0.9.3-150400.3.3.1 * avif-tools-0.9.3-150400.3.3.1 * openSUSE Leap 15.4 (x86_64) * libavif13-32bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-32bit-0.9.3-150400.3.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libavif13-64bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-64bit-0.9.3-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif-devel-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-debuginfo-0.9.3-150400.3.3.1 * gdk-pixbuf-loader-libavif-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * avif-tools-debuginfo-0.9.3-150400.3.3.1 * avif-tools-0.9.3-150400.3.3.1 * openSUSE Leap 15.5 (x86_64) *libavif13-32bit-debuginfo-0.9.3-150400.3.3.1 * libavif13-32bit-0.9.3-150400.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Proxy 4.3 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libavif-debugsource-0.9.3-150400.3.3.1 * libavif13-0.9.3-150400.3.3.1 * libavif13-debuginfo-0.9.3-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6704.html * https://bugzilla.suse.com/show_bug.cgi?id=1218303 . Patch addresses significant vulnerabilities impacting various SUSE releases regarding libavif, reinforcingsystem integrity and safety.. SUSE, Libavif, Security Update, Software Patching, System Stability. . Severity: Important. LinuxSecurity.com Team
Feb 08, 2024
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!