NIXPKGS-2026-0042

published 6 months ago

Permalink CVE-2025-62398

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted maintainer @freezeboy 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: possible to bypass mfa

• https://access.redhat.com/security/cve/CVE-2025-62398 x_refsource_REDHATvdb-entry
• RHBZ#2404431 issue-trackingx_refsource_REDHAT

---

moodle

• <4.5.7
• <5.0.3
• <4.4.11

NIXPKGS-2026-0041

published 6 months ago

Permalink CVE-2025-62399

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted maintainer @freezeboy 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: password brute force risk when mobile/web services enabled

• https://access.redhat.com/security/cve/CVE-2025-62399 x_refsource_REDHATvdb-entry
• RHBZ#2404432 issue-trackingx_refsource_REDHAT

---

moodle

• <4.5.7
• <5.0.3
• <4.4.11
• <4.1.21

NIXPKGS-2026-0040

published 6 months ago

Permalink CVE-2025-62397

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted
  2 maintainers

  • @kmein
  • @freezeboy
  6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: router produces json instead of 404 error for invalid course id

• https://access.redhat.com/security/cve/CVE-2025-62397 x_refsource_REDHATvdb-entry
• RHBZ#2404430 issue-trackingx_refsource_REDHAT

---

moodle

• <5.0.3

NIXPKGS-2026-0039

published 6 months ago

Permalink CVE-2025-62393

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted maintainer @freezeboy 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: course access permissions not properly checked in course_output_fragment_course_overview

• https://access.redhat.com/security/cve/CVE-2025-62393 x_refsource_REDHATvdb-entry
• RHBZ#2404426 issue-trackingx_refsource_REDHAT
• https://moodle.org/mod/forum/discuss.php?d=470381

---

moodle

• <5.0.3

NIXPKGS-2026-0038

published 6 months ago

Permalink CVE-2025-62400

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted
  2 maintainers

  • @kmein
  • @freezeboy
  6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: hidden group names visible to event creators

• https://access.redhat.com/security/cve/CVE-2025-62400 x_refsource_REDHATvdb-entry
• RHBZ#2404433 issue-trackingx_refsource_REDHAT

---

moodle

• <4.5.7
• <5.0.3
• <4.4.11
• <4.1.21

NIXPKGS-2026-0028

published 6 months ago

Permalink CVE-2026-22854

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 6 months ago
• @LeSuisse deleted maintainer @peterhoeg 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

FreeRDP has a heap-buffer-overflow in drive_process_irp_read

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf x_refsource_CONFIRM
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.20.1 x_refsource_MISC

---

FreeRDP

• ==< 3.20.1

NIXPKGS-2026-0037

published 6 months ago

Permalink CVE-2025-62394

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted maintainer @freezeboy 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: quiz notifications sent to suspended participants

• https://access.redhat.com/security/cve/CVE-2025-62394 x_refsource_REDHATvdb-entry
• RHBZ#2404427 issue-trackingx_refsource_REDHAT

---

moodle

• <4.5.7
• <5.0.3

NIXPKGS-2026-0036

published 6 months ago

Permalink CVE-2025-62401

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored package moodle-dl 6 months ago
• @LeSuisse deleted maintainer @freezeboy 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Moodle: possible to bypass timer in timed assignments

• https://access.redhat.com/security/cve/CVE-2025-62401 x_refsource_REDHATvdb-entry
• RHBZ#2404434 issue-trackingx_refsource_REDHAT

---

moodle

• <4.5.7
• <5.0.3
• <4.4.11
• <4.1.21

NIXPKGS-2026-0035

published 6 months ago

Permalink CVE-2025-11731

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored
  2 packages

  • python312Packages.libxslt
  • python313Packages.libxslt
  6 months ago
• @LeSuisse deleted maintainer @jtojnar 6 months ago maintainer.delete
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Libxslt: type confusion in exsltfuncresultcompfunction of libxslt

• https://access.redhat.com/security/cve/CVE-2025-11731 x_refsource_REDHATvdb-entry
• RHBZ#2403688 issue-trackingx_refsource_REDHAT
• https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78

---

rhcos

libxslt

• <1.1.44

NIXPKGS-2026-0034

GitHub issue published 6 months ago

Permalink CVE-2025-12105

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 6 months ago by @LeSuisse Activity log

• Created suggestion 8 months ago
• @LeSuisse ignored
  2 packages

  • tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4"
  • libsoup_2_4
  6 months ago
• @LeSuisse accepted 6 months ago
• @LeSuisse published on GitHub 6 months ago

Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion

• https://access.redhat.com/security/cve/CVE-2025-12105 x_refsource_REDHATvdb-entry
• RHBZ#2405992 issue-trackingx_refsource_REDHAT
• RHSA-2025:23139 x_refsource_REDHATvendor-advisory
• RHSA-2025:23437 x_refsource_REDHATvendor-advisory

---

libsoup

• =<3.6.5

libsoup3

• *

Upstream fix: https://gitlab.gnome.org/GNOME/libsoup/-/commit/9ba1243a24e442fa5ec44684617a4480027da960