A 9.8 ksmbd auth bypass headlines a messy Linux Monday

An integer overflow in libssh2's publickey subsystem attribute allocation can corrupt memory when handling crafted SSH responses. An attacker controlling or intercepting an SSH server could trigger this during publickey authentication. Exploitation complexity is higher here (CVSS 7.0), but any tool or service that uses libssh2 for outbound SSH connections is exposed.

Affected estate

Anyone running libssh 0.10.6-8 or libssh2 1.11.1-3 on Azure Linux 3.0, or any system using these library versions for SSH client operations

How to check

Run `rpm -q libssh libssh2` or `tdnf list installed | grep libssh` to check installed versions.

Included because

memory corruption; SSH client library; common dependency; CVSS 7.0

Action

Update both packages via tdnf and restart any services that link against libssh or libssh2.

Why it matters

Memory corruption during SSH authentication could let a malicious or compromised SSH server execute code on your client system.

Source

Azure Linux advisory

A path traversal bug in libzypp (the package management engine behind zypper) lets a malicious repository overwrite arbitrary files on your system when you refresh or install from it. Since libzypp runs with root privileges during package operations, this can lead straight to privilege escalation. You're only at risk if you add third-party or untrusted repos, but that's common enough in practice.

Affected estate

Anyone running SUSE or openSUSE systems with libzypp before 17.38.10, especially hosts configured with third-party repositories

How to check

Run `rpm -q libzypp` to check the installed version.

Included because

path traversal; runs as root; remote trigger via repository metadata; CVSS 8.8

Action

Update libzypp to 17.38.10+ with `zypper update libzypp` and review configured repositories with `zypper lr`.

Why it matters

A malicious repo can overwrite system files as root during normal package operations, giving an attacker full control of the host.

The file upload endpoint in ruoyi-vue-pro (a popular open-source Java admin framework) has a path traversal bug that lets a remote attacker write files to arbitrary locations on the server. A public exploit already exists. If you run this framework, especially internet-facing, an attacker can likely drop a webshell or overwrite config files without authentication barriers.

Affected estate

Anyone running YunaiV ruoyi-vue-pro up to the 2026.04-jdk8-SNAPSHOT release

How to check

Check your deployed version against the git log. Look for commit 4ae3f6b2c9 in your codebase. If it's missing, you're vulnerable.

Included because

path traversal; remote exploitation; public exploit available; file upload endpoint; CVSS 7.3

Action

Cherry-pick commit 4ae3f6b2c9883978837638c14e3d18419819eeb0 or update to the latest release, then redeploy.

Why it matters

Public exploit plus arbitrary file write on a web-facing app means attackers can drop webshells or overwrite configs remotely.

ANTLR4 (up to version 4.13.2) has a code injection bug in its grammar action block handler. If you use ANTLR to compile untrusted or user-supplied grammars, an attacker can inject arbitrary code into the generated output. This only matters if your build pipeline or tooling processes grammar files from untrusted sources. If you only compile your own grammars, your risk is low.

Affected estate

Developers and build pipelines using ANTLR4 up to 4.13.2 that process grammars from untrusted or user-submitted sources

How to check

Check your ANTLR4 dependency version in pom.xml, build.gradle, or equivalent. Versions up to 4.13.2 are affected.

Included because

code injection; remote trigger possible; public exploit available; no vendor response

Action

Avoid compiling untrusted grammar files. Pin ANTLR4 and watch the upstream repo for a security release.

Why it matters

If your pipeline compiles attacker-controlled grammars, injected code runs with the privileges of your build process.