OpenSSL CMS forgery bug scores 9.1, plus a buffer overflow in Apache mod_proxy_html

A use-after-free bug in the Linux kernel's Topcliff PCH SPI driver can be triggered during device unbind. A local attacker with access to trigger driver unbind operations could escalate privileges or crash the system. This only affects you if you're running hardware that uses the Topcliff PCH SPI controller, which is uncommon outside certain embedded Intel platforms.

Included because

CVSS 7.8; local privilege escalation; requires specific hardware driver to be loaded

Affected estate

Azure Linux 3.0 systems running kernel 6.6.139.1-1.

How to check

Run `uname -r` and check if it matches 6.6.139.1-1. Also check `lsmod | grep spi_topcliff_pch` to see if the affected driver is loaded.

Action

Run `tdnf update kernel` and schedule a reboot.

Urgency

Patch this week

Why it matters

A local privilege escalation via a use-after-free could give an attacker full kernel control.

Source

NVD

A vulnerability in libnfs 5.0.2 on Azure Linux 3.0. Details are sparse (no description provided), but the CVSS 7.1 score suggests a significant impact, likely involving NFS client-side operations. If you mount NFS shares using libnfs, treat this as a real risk until more details surface.

Included because

CVSS 7.1; limited detail increases uncertainty; common NFS client library

Affected estate

Azure Linux 3.0 systems with libnfs 5.0.2-1 installed.

How to check

Run `tdnf list installed libnfs` and confirm the version.

Action

Run `tdnf update libnfs` to install the patched version.

Urgency

Patch this week

Why it matters

libnfs bugs can affect any workload mounting NFS shares, and the lack of a public description makes risk assessment harder.

Source

NVD

The form-data library fails to escape carriage returns, line feeds, and quotes in multipart field names and filenames. An attacker who controls input to a form-data request can inject arbitrary HTTP headers (CRLF injection), potentially smuggling requests or poisoning responses. This surfaces in the python-tensorboard package on Azure Linux 3.0, which bundles or depends on the vulnerable library.

Included because

CVSS 7.5; network-exploitable; CRLF injection in a common library pattern

Affected estate

Azure Linux 3.0 systems with python-tensorboard 2.16.2-6 installed.

How to check

Run `tdnf list installed python-tensorboard` and confirm the version. Also check `pip show tensorboard` if installed via pip.

Action

Run `tdnf update python-tensorboard` to install the fixed version.

Urgency

Patch this week

Why it matters

CRLF injection can be chained into request smuggling or session hijacking if the service handles untrusted input in multipart form fields.

Source

NVD

A buffer overflow in Apache HTTP Server's mod_proxy_html module lets a remote attacker send crafted content through the reverse proxy that overflows a buffer. If you use mod_proxy_html to rewrite HTML in proxied responses, this is exploitable over the network without authentication. No exploitation in the wild yet, but buffer overflows in internet-facing web servers deserve fast attention.

Included because

CVSS 7.5; unauthenticated; internet-facing; buffer overflow in widely deployed web server

Affected estate

Azure Linux 3.0 systems running httpd 2.4.67-1 with mod_proxy_html loaded.

How to check

Run `httpd -v` to confirm the version and `httpd -M | grep proxy_html` to check if the module is loaded.

Action

Run `tdnf update httpd` and restart the service with `systemctl restart httpd`.

Urgency

Patch within 24 hours

Why it matters

A buffer overflow in an internet-facing reverse proxy module can lead to remote code execution with no authentication required.

Source

NVD