CVE-2025-49844

🚨 CVE-2025-49844 — “RediShell” 세계에서 가장 빠른 인메모리 스토어에서의 치명적인 원격 코드 실행 Redis Lua 스크립팅이 이제 완벽한 인증 후 착륙 지점이 되었습니다. 인증된 공격자 → 조작된 Lua 스크립트 → 샌드박스 탈출 → 호스트에서의 완전한 RCE ⚠️ 개요 CVE-2025-49844"RediShell "는 Redis 에 내장된 Lua 스크립팅 엔진에서 발생하는 치명적인 use-after-freeUAF 메모리 손상 취약점입니다. 인증된 사용자가 EVAL / EVALSHA를 통해 특수하게 조작...

bad_garbage

BADGARBAGE.c CVE-2026-53361 — AFUNIX 소켓 가비지 컬렉터에서 발생하는 비특권·컨테이너 탈출 가능한 use-after-free 취약점. 단일 벡터MSGPEEK 전용 버전이다. 버그 AFUNIX GC는 도달할 수 없는 참조 순환을 형성하는 "in-flight" 소켓을 재확보한다. in-flight fd에 대한 동시 MSGPEEK는 GC의 집계가 절대 세지 않는 참조를 가져가므로, 수집기가 여전히 살아있는 소켓을 해제하고 댕글링 skbuff를 남길 수 있다. peek는 수집이 실행되는 동안 백오프하도록 ...

CVE-2020-0674

CVE-2020-0674 CVE-2020-0674는 레거시 jscript 엔진의 use-after-free 취약점입니다. Internet Explorer에서 트리거할 수 있습니다. 여기 있는 익스플로잇은 maxpl0it이 작성했지만, 취약점 자체는 Qihoo 360에 의해 실제 공격에서 사용되는 것이 발견되었습니다. 이 익스플로잇은 단순히 계산기를 실행합니다. 익스플로잇 분석 글은 여기에서 확인할 수 있습니다. 취약점 개요 이 취약점은 비교자 함수를 사용할 때 Array sort 함수에 존재합니다. 비교자 함수에 제공되는 두...

Rocky Linux 9 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231879 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 8 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1898)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231898 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 8 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1895)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231895 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 9 [CIQ] Security Update: java-11-openjdk / java-11-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1880)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231880 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 10.0 [CIQ] Security Update: java-21-openjdk / java-21-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10873)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510873 advisory. JDK: Better Glyph drawing CVE-2025-30749 JDK: Enhance TLS protocol support CVE-2025-30754 JDK: Improve HTTP client header handling CVE-2025-50059 JDK:...

Rocky Linux 9 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1909)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231909 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

uaf-2023-28205

CVE-2023-28205: Apple WebKit 사용 후 해제Use-After-Free 취약점 이 취약점은 악의적으로 제작된 웹 콘텐츠를 통해 악용될 수 있으며, 공격자가 임의 코드를 실행할 수 있게 합니다. 설명 코드는 Map 및 Date 객체의 추가를 지연시켜 가비지 컬렉터GC가 이를 해제하도록 함으로써 use-after-freeUAF 취약점을 유발합니다. 이는 잠재적으로 해제된 객체에 접근하여 메모리 손상을 일으키거나 익스플로잇을 가능하게 할 수 있습니다. 참조 WebKit Commit...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: clone set element expression template The memcpy function breaks when using connlimit in set elements. Use nftexprclone to initialize the connlimit expression list; otherwise, the connlimit garbage collect...

Astra Linux – Vulnerability in Firefox

If array shift operations are not used, the Garbage Collector may become confused regarding valid objects. This vulnerability affects Firefox versions less than 101...

Astra Linux – Vulnerability in Firefox and Thunderbird

Certain types of allocations lacked annotations that, if the Garbage Collector was in a specific state, could have led to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ipset: Fixed issues related to region locking in hash types. The region locking mechanism introduced in v5.6-rc4 included three macros for handling region locks: ahashbucketstart, ahashbucketend which return the sta...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 GA retains the legacy AFUNIX garbage collector, but the upstream commit 8594d9b85c07 "afunix: Do not call skbget for OOB skb" addresses this issue. When orphaned MSGOOB sockets reach unixgc, the garbage collector still calls kfreeskb, assuming that OOB SKBs hold two references...

CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

Redis < 6.2.20 / 7.0.x < 7.2.11 / 7.4.x < 7.4.6 / 8.0.x < 8.0.4 / 8.2.x < 8.2.2 RCE (RediShell)

The version of Redis installed on the remote host is prior to 6.2.20, 7.0.x prior to 7.2.11, 7.4.x prior to 7.4.6, 8.0.x prior to 8.0.4, or 8.2.x prior to 8.2.2. It is, therefore, affected by a vulnerability as referenced in the security advisory. - A use-after-free vulnerability in the Lua...

UBUNTU-CVE-2026-74937

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-66686

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66686

Summary: CVE-2026-66686 is an Unauthenticated CSRF vulnerability in the WordPress plugin Plugins Garbage Collector (Database Cleanup) , affecting versions ≤ 0.14. The vulnerability is described as unauthenticated CSRF, implying an attacker could induce actions on behalf of a user without requirin...