SB2025080448 - Dell EMC NetWorker vProxy update for third-party components
Published: August 4, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2025-0395)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when the assert() function fails. A remote attacker can trigger memory corruption and perform a denial of service (DoS) attack.
2) Integer overflow (CVE-ID: CVE-2025-0690)
The vulnerability allows an attacker to escalate privileges on the system.
The vulnerability exists due to integer overflow when reading data from the keyboard input. An attacker with physical access to the system can trigger an integer overflow and execute arbitrary code with elevated privileges.
3) Integer overflow (CVE-ID: CVE-2025-1125)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow within the hfsplus_open_compressed_real() function when reading data from a hfs filesystem. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.
4) Heap-based buffer overflow (CVE-ID: CVE-2025-0689)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the grub_udf_read_block() function when reading data from disk. A local user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
5) Integer overflow (CVE-ID: CVE-2025-0686)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow within the grub_romfs_read_symlink() function when performing a symlink lookup from a romfs filesystem. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.
6) Out-of-bounds write (CVE-ID: CVE-2025-0624)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the grub_net_search_config_file() function. A local user can trigger an out-of-bounds write and execute arbitrary code on the system.
7) Use-after-free (CVE-ID: CVE-2025-0622)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error caused by not removing hooks when the related module is being unloaded. A local user can execute arbitrary code with elevated privileges.
8) Integer overflow (CVE-ID: CVE-2025-0677)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to integer overflow when performing a symlink lookup within the grub_ufs_lookup_symlink() function in UFS filesystem driver. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.
9) Security features bypass (CVE-ID: CVE-2025-1118)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the dump command is not blocked when grub is in lockdown mode. A local user can read any data from the system memory.
10) Integer overflow (CVE-ID: CVE-2025-0725)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when handling gzip decompression of content-encoded HTTP responses with the CURLOPT_ACCEPT_ENCODING option using zlib 1.2.0.3 or older. A remote attacker can send specially crafted response to the application, trigger an integer overflow and execute arbitrary code on the target system.
11) Information disclosure (CVE-ID: CVE-2025-0167)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to application can leak credentials when asked to use a .netrc file for credentials and to follow HTTP redirects. A remote attacker can gain access to sensitive information.
12) Stack-based buffer overflow (CVE-ID: CVE-2025-24928)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the xmlSnprintfElements() function in valid.c. A remote attacker can pass specially crafted XML data to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
13) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2025-26465)
The vulnerability allows a remote attacker to perform MitM attack.
The
vulnerability exists due to incorrect processing of user-supplied data
in ssh(1). A remote attacker can perform server impersonation when
VerifyHostKeyDNS enabled.
Remediation
Install update from vendor's website.