Publish Advisories

advisory-database[bot] · advisory-database[bot] · commit 292303a4262b · 2025-12-03T00:32:16.000Z
GHSA-2hxr-f3r4-c6v6 GHSA-2m6w-285w-23qv GHSA-5g77-57xq-24cv GHSA-7r5q-7rq4-xmm9 GHSA-h83f-v73c-v6q4 GHSA-j6xg-g9vq-x958 GHSA-jqqf-9279-r3qm GHSA-phc8-67cv-f47x GHSA-rwpj-m8w9-33j2 GHSA-w39f-4cm2-25x2 GHSA-pgj7-6v58-mxr9 GHSA-2c6f-5h2f-xj25 GHSA-6pgw-376w-jrxx GHSA-7c64-f9jr-v9h2 GHSA-886p-82g3-p77g GHSA-8xvq-hhq9-99ff GHSA-9cpm-2q59-cph3 GHSA-c8g4-h8j5-vjpp GHSA-cp97-pqrj-xpvw GHSA-h5pr-3m5w-7gm8 GHSA-x93g-7wjc-5jqw
diff --git a/advisories/unreviewed/2022/05/GHSA-2hxr-f3r4-c6v6/GHSA-2hxr-f3r4-c6v6.json b/advisories/unreviewed/2022/05/GHSA-2hxr-f3r4-c6v6/GHSA-2hxr-f3r4-c6v6.json
@@ -43,6 +43,7 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-119",
+      "CWE-20",
       "CWE-787"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/05/GHSA-2m6w-285w-23qv/GHSA-2m6w-285w-23qv.json b/advisories/unreviewed/2022/05/GHSA-2m6w-285w-23qv/GHSA-2m6w-285w-23qv.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2m6w-285w-23qv",
-  "modified": "2023-01-11T09:30:32Z",
+  "modified": "2025-12-03T00:30:25Z",
   "published": "2022-05-24T19:13:10Z",
   "aliases": [
     "CVE-2021-39252"
@@ -31,6 +31,14 @@
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
@@ -50,7 +58,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-125"
+      "CWE-125",
+      "CWE-20"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2022/05/GHSA-5g77-57xq-24cv/GHSA-5g77-57xq-24cv.json b/advisories/unreviewed/2022/05/GHSA-5g77-57xq-24cv/GHSA-5g77-57xq-24cv.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5g77-57xq-24cv",
-  "modified": "2023-01-11T09:30:32Z",
+  "modified": "2025-12-03T00:30:26Z",
   "published": "2022-05-24T19:13:10Z",
   "aliases": [
     "CVE-2021-39253"
@@ -31,6 +31,14 @@
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
@@ -50,7 +58,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-125"
+      "CWE-125",
+      "CWE-20"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2022/05/GHSA-7r5q-7rq4-xmm9/GHSA-7r5q-7rq4-xmm9.json b/advisories/unreviewed/2022/05/GHSA-7r5q-7rq4-xmm9/GHSA-7r5q-7rq4-xmm9.json
@@ -43,6 +43,7 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-119",
+      "CWE-20",
       "CWE-787"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/05/GHSA-h83f-v73c-v6q4/GHSA-h83f-v73c-v6q4.json b/advisories/unreviewed/2022/05/GHSA-h83f-v73c-v6q4/GHSA-h83f-v73c-v6q4.json
@@ -42,6 +42,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-787"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/05/GHSA-j6xg-g9vq-x958/GHSA-j6xg-g9vq-x958.json b/advisories/unreviewed/2022/05/GHSA-j6xg-g9vq-x958/GHSA-j6xg-g9vq-x958.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-j6xg-g9vq-x958",
-  "modified": "2023-01-11T09:30:32Z",
+  "modified": "2025-12-03T00:30:26Z",
   "published": "2022-05-24T19:13:09Z",
   "aliases": [
     "CVE-2021-39254"
@@ -31,6 +31,14 @@
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
@@ -50,7 +58,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-190"
+      "CWE-190",
+      "CWE-20"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2022/05/GHSA-jqqf-9279-r3qm/GHSA-jqqf-9279-r3qm.json b/advisories/unreviewed/2022/05/GHSA-jqqf-9279-r3qm/GHSA-jqqf-9279-r3qm.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jqqf-9279-r3qm",
-  "modified": "2023-01-11T09:30:32Z",
+  "modified": "2025-12-03T00:30:25Z",
   "published": "2022-05-24T19:13:11Z",
   "aliases": [
     "CVE-2021-35268"
@@ -27,6 +27,14 @@
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
@@ -58,6 +66,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-787"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/05/GHSA-phc8-67cv-f47x/GHSA-phc8-67cv-f47x.json b/advisories/unreviewed/2022/05/GHSA-phc8-67cv-f47x/GHSA-phc8-67cv-f47x.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-125"
+      "CWE-125",
+      "CWE-20"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2022/05/GHSA-rwpj-m8w9-33j2/GHSA-rwpj-m8w9-33j2.json b/advisories/unreviewed/2022/05/GHSA-rwpj-m8w9-33j2/GHSA-rwpj-m8w9-33j2.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rwpj-m8w9-33j2",
-  "modified": "2023-01-11T09:30:32Z",
+  "modified": "2025-12-03T00:30:26Z",
   "published": "2022-05-24T19:13:10Z",
   "aliases": [
     "CVE-2021-39251"
@@ -39,6 +39,14 @@
       "type": "WEB",
       "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSEKTKHO5HFZHWZNJNBJZA56472KRUZI"
+    },
     {
       "type": "WEB",
       "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/766ISTT3KCARKFUIQT7N6WV6T63XOKG3"
@@ -62,6 +70,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-476"
     ],
     "severity": "HIGH",
diff --git a/advisories/unreviewed/2022/05/GHSA-w39f-4cm2-25x2/GHSA-w39f-4cm2-25x2.json b/advisories/unreviewed/2022/05/GHSA-w39f-4cm2-25x2/GHSA-w39f-4cm2-25x2.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-125"
+      "CWE-125",
+      "CWE-20"
     ],
     "severity": "HIGH",
     "github_reviewed": false,
diff --git a/advisories/unreviewed/2025/09/GHSA-pgj7-6v58-mxr9/GHSA-pgj7-6v58-mxr9.json b/advisories/unreviewed/2025/09/GHSA-pgj7-6v58-mxr9/GHSA-pgj7-6v58-mxr9.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pgj7-6v58-mxr9",
-  "modified": "2025-09-16T15:32:33Z",
+  "modified": "2025-12-03T00:30:27Z",
   "published": "2025-09-16T15:32:33Z",
   "aliases": [
     "CVE-2023-53279"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: vmw_balloon: fix memory leak with using debugfs_lookup()\n\nWhen calling debugfs_lookup() the result must have dput() called on it,\notherwise the memory will leak over time.  To make things simpler, just\ncall debugfs_lookup_and_remove() instead which handles all of the logic at\nonce.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -32,8 +37,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-09-16T08:15:36Z"
diff --git a/advisories/unreviewed/2025/12/GHSA-2c6f-5h2f-xj25/GHSA-2c6f-5h2f-xj25.json b/advisories/unreviewed/2025/12/GHSA-2c6f-5h2f-xj25/GHSA-2c6f-5h2f-xj25.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2c6f-5h2f-xj25",
-  "modified": "2025-12-02T21:31:29Z",
+  "modified": "2025-12-03T00:30:28Z",
   "published": "2025-12-02T21:31:29Z",
   "aliases": [
     "CVE-2025-13637"
   ],
   "details": "Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-449"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-12-02T19:15:48Z"
diff --git a/advisories/unreviewed/2025/12/GHSA-6pgw-376w-jrxx/GHSA-6pgw-376w-jrxx.json b/advisories/unreviewed/2025/12/GHSA-6pgw-376w-jrxx/GHSA-6pgw-376w-jrxx.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6pgw-376w-jrxx",
-  "modified": "2025-12-02T21:31:29Z",
+  "modified": "2025-12-03T00:30:28Z",
   "published": "2025-12-02T21:31:29Z",
   "aliases": [
     "CVE-2025-13636"
   ],
   "details": "Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -24,8 +29,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-290"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-12-02T19:15:48Z"
diff --git a/advisories/unreviewed/2025/12/GHSA-7c64-f9jr-v9h2/GHSA-7c64-f9jr-v9h2.json b/advisories/unreviewed/2025/12/GHSA-7c64-f9jr-v9h2/GHSA-7c64-f9jr-v9h2.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7c64-f9jr-v9h2",
-  "modified": "2025-12-02T21:31:30Z",
+  "modified": "2025-12-03T00:30:28Z",
   "published": "2025-12-02T21:31:30Z",
   "aliases": [
     "CVE-2025-61729"
   ],
   "details": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -33,7 +38,7 @@
   ],
   "database_specific": {
     "cwe_ids": [],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2025-12-02T19:15:51Z"
diff --git a/advisories/unreviewed/2025/12/GHSA-886p-82g3-p77g/GHSA-886p-82g3-p77g.json b/advisories/unreviewed/2025/12/GHSA-886p-82g3-p77g/GHSA-886p-82g3-p77g.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-886p-82g3-p77g",
+  "modified": "2025-12-03T00:30:28Z",
+  "published": "2025-12-03T00:30:28Z",
+  "aliases": [
+    "CVE-2025-55181"
+  ],
+  "details": "Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55181"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/facebook/proxygen/commit/17689399ef99b7c3d3a8b2b768b1dba1a4b72f8f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.facebook.com/security/advisories/cve-2025-55181"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-12-02T22:16:08Z"
+  }
+}
diff --git a/advisories/unreviewed/2025/12/GHSA-8xvq-hhq9-99ff/GHSA-8xvq-hhq9-99ff.json b/advisories/unreviewed/2025/12/GHSA-8xvq-hhq9-99ff/GHSA-8xvq-hhq9-99ff.json
diff --git a/advisories/unreviewed/2025/12/GHSA-9cpm-2q59-cph3/GHSA-9cpm-2q59-cph3.json b/advisories/unreviewed/2025/12/GHSA-9cpm-2q59-cph3/GHSA-9cpm-2q59-cph3.json
diff --git a/advisories/unreviewed/2025/12/GHSA-c8g4-h8j5-vjpp/GHSA-c8g4-h8j5-vjpp.json b/advisories/unreviewed/2025/12/GHSA-c8g4-h8j5-vjpp/GHSA-c8g4-h8j5-vjpp.json
diff --git a/advisories/unreviewed/2025/12/GHSA-cp97-pqrj-xpvw/GHSA-cp97-pqrj-xpvw.json b/advisories/unreviewed/2025/12/GHSA-cp97-pqrj-xpvw/GHSA-cp97-pqrj-xpvw.json
diff --git a/advisories/unreviewed/2025/12/GHSA-h5pr-3m5w-7gm8/GHSA-h5pr-3m5w-7gm8.json b/advisories/unreviewed/2025/12/GHSA-h5pr-3m5w-7gm8/GHSA-h5pr-3m5w-7gm8.json
diff --git a/advisories/unreviewed/2025/12/GHSA-x93g-7wjc-5jqw/GHSA-x93g-7wjc-5jqw.json b/advisories/unreviewed/2025/12/GHSA-x93g-7wjc-5jqw/GHSA-x93g-7wjc-5jqw.json
