Astra Linux – Vulnerability in binutils

A issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in the processmipsspecific function in readelf.c, due to a malformed MIPS option section...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in bfddoprnt in bfd.c, due to elfobjectp in elfcode.h mishandling an eshstrndx section of type SHTGROUP by omitting a trailing '\0'...

Astra Linux – Vulnerability in ntfs-3g

In NTFS-3G versions before version 2021.8.22, when a specially crafted MFT section is provided in an NTFS image, a heap buffer overflow may occur, allowing code execution...

Astra Linux – Vulnerability in Zabbix

The cause of the vulnerability is improper validation of the “Name” field in the form input on the Graph page in the Items section...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/tm: Fixed corruption in user space r13. The commit cf13435b730a “powerpc/tm: Fixed corruption in user space r13” fixes a problem in treclaim, where a SLB miss can occur in threadstruct-ckpt regs, when SCRATCH0 is active a...

Astra Linux – Vulnerability in binutils

The loadspecificdebugsection function in objdump.c within GNU Binutils, as of version 2.31.1, contains an integer overflow vulnerability that can trigger a heap-based buffer overflow if a crafted section size is used...

Astra Linux – Vulnerability in TIF format

A heap buffer overflow in the ExtractImageSection function within the tiffcrop.c file in the libtiff library version 4.3.0 allows attackers to trigger unsafe or out-of-bounds memory access through a crafted TIFF image file. This could lead to application crashes, potential information disclosure,...

CVE-2026-90829: NULL Pointer Dereference

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfdelfsetgroupcontents of the file bfd/elf.c of the component SHTGROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been...

PT-2026-91753

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.47 Description A flaw in the ELF Orphan Section Handler component allows a local attacker to cause a null pointer dereference, which occurs when the system attempts to read or write to a memory address that is null,...

CVE-2026-90804: Buffer Copy without Checking Size of Input

A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function bfdelfwritesectionehframe of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cielength/fdelength/augmentationdatasize/writeoffset results in...

CVE-2026-90828: NULL Pointer Dereference

A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elforphancompatible of the file ld/ldelf.c of the component ELF Orphan Section Handler. Performing a manipulation results in null pointer dereference. The attack must be initiated from a local...

CVE-2026-90830: NULL Pointer Dereference

A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function bfdwritemergedsection of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed...

PT-2026-91761

A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function bfd write merged section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed...

PT-2026-91276

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.47 Description A buffer overflow occurs in the Eh Frame Section Handler component within the bfd elf write section eh frame function of the bfd/elf-eh-frame.c file. This issue is triggered by the manipulation of the cie...

Linux Distros Unpatched Vulnerability : CVE-2026-89556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS...

Linux Distros Unpatched Vulnerability : CVE-2026-89588

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining...

CVE-2026-54174

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

EUVD-2026-76767

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...