---
title: "Security digest: February 6, 2025"
url: https://erroneo.us/security/2025-02-06/
description: "February 6, 2025 vulnerability digest: 5 CISA KEV additions (7-Zip, Audinate, Microsoft, Sophos); 3 critical advisories (Composer (PHP), npm, Go). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-02-06
date_modified: 2025-02-06
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 6, 2025

5 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? 7-Zip 7-Zip, Microsoft Office Outlook, Audinate Dante Discovery, Sophos CyberoamOS, Sophos XG Firewall. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-02-27.
- Composer (PHP): 1 critical advisory ( rudloff/rtmpdump-bin ). Check with composer audit .
- npm: 1 critical advisory ( @nuxtjs/mdc ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/clidey/whodb/core ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2025-0411](https://erroneo.us/security/cve/CVE-2025-0411/index.md) 7-Zip 7-Zip: 7-Zip Mark of the Web Bypass Vulnerability (CISA due 2025-02-27)
- [CVE-2024-21413](https://erroneo.us/security/cve/CVE-2024-21413/index.md) Microsoft Office Outlook: Microsoft Outlook Improper Input Validation Vulnerability (CISA due 2025-02-27)
- [CVE-2022-23748](https://erroneo.us/security/cve/CVE-2022-23748/index.md) Audinate Dante Discovery: Dante Discovery Process Control Vulnerability (CISA due 2025-02-27)
- [CVE-2020-29574](https://erroneo.us/security/cve/CVE-2020-29574/index.md) Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability (CISA due 2025-02-27)
- [CVE-2020-15069](https://erroneo.us/security/cve/CVE-2020-15069/index.md) Sophos XG Firewall: Sophos XG Firewall Buffer Overflow Vulnerability (CISA due 2025-02-27)

## Critical advisories

- [GHSA-vrpv-vw92-328g](https://erroneo.us/security/ghsa/GHSA-vrpv-vw92-328g/index.md) Multiple rtmpdump vulnerabilities — Composer (PHP) rudloff/rtmpdump-bin <= 2.3.1 → no fix
- [CVE-2025-24981](https://erroneo.us/security/cve/CVE-2025-24981/index.md) Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc — npm @nuxtjs/mdc <= 0.13.2 → 0.13.3
- [CVE-2025-24786](https://erroneo.us/security/cve/CVE-2025-24786/index.md) WhoDB has a path traversal opening Sqlite3 database — Go github.com/clidey/whodb/core < 0.0.0-20250127172032-547336ac73c8 → 0.0.0-20250127172032-547336ac73c8

---
Source page: https://erroneo.us/security/2025-02-06/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt