Astra Linux – Vulnerability in Chromium

Using “after free” in Media Stream in Google Chrome before version 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in liblivemedia

Live555 suffers from 1.08, which mishandles large requests for the same MP3 stream, leading to recursion and excessive buffer overflows based on the stack mechanism. An attacker can exploit this vulnerability to launch a DoS attack...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A denial-of-service vulnerability due to a deadlock was discovered in sctpautoasconfinit in the net/sctp/socket.c file within the SCTP subsystem of the Linux kernel. This flaw allows users with local user privileges to trigger a deadlock and potentially cause the system to crash...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Media: dvb-usb: fixed a memory leak in dvbusbadapterinit Syzbot reported a memory leak in “dvbusbadapterinit.” The leak occurs because the current iteration’s adapter-priv is not freed in case of an error. Currently, if an error...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check the correct bounds for stream encoder instances for DCN303 Why & How The engid for DCN303 cannot be more than 1, since we have only two instances of stream encoders. Check the correct boundary condition for...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A null pointer dereference issue was discovered in the SCTP network protocol within the net/sctp/streamsched.c file in the Linux kernel. If the streamin allocation fails, the streamout resource is freed, allowing further access to it. A local user could exploit this vulnerability to crash the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A memory leak flaw was discovered in the Linux kernel’s Stream Control Transmission Protocol. This issue may occur when a user initiates a malicious networking service, and someone connects to this service. This could allow a local user to deplete resources, resulting in a denial of service...

Astra Linux – Vulnerability in ffmpeg

A null pointer dereference issue was discovered in ‘FFmpeg’ within the decodemainheader function of the libavformat/nutdec.c file. The flaw occurs because the function does not check the return value of avformatnewstream, leading to a null pointer dereference error, which can cause the applicatio...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. No users are affected if they follow the recommendation...

Astra Linux – Vulnerability in Chromium

The use of after-free in MediaStream in Google Chrome before version 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Poppler

The JPXStream::init function in Poppler 0.78.0 and earlier does not check for negative values of stream length, which can lead to an Integer Overflow. This allows an attacker to allocate a large memory chunk on the heap, with the size controlled by them. This issue was demonstrated by pdftocairo...

BIT-VALKEY-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

PT-2026-80002

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2026-80902

The UMP Stream responder library in lib/midi2/ump stream responder.c builds reply packets in a 16-byte struct midi ump uint32 t data4. The builders make endpoint info and make function block info populate only the first two words res.data0 and res.data1 and, before this fix, declared their result...

CVE-2026-77639

A flaw was found in Tor. A remote attacker could exploit a compression bomb bypass vulnerability by concatenating multiple gzip or zlib sub-streams. Each sub-stream, individually below the detection threshold, could collectively bypass the compression bomb check, leading to a Denial of Service Do...

CVE-2026-77640

A flaw was found in tor. A remote attacker could send a specially crafted, truncated zlib/gzip stream. This could lead to an infinite loop during decompression, causing a denial of service DoS in the affected component. Mitigation Mitigation for this issue is either not available or the currently...

SUSE CVE-2026-77584

Tor before 0.4.9.10 did not reject a CONFLUXLINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAYCOMMANDBEGIN before the CONFLUXLINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit...

CVE-2026-62283

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

EUVD-2026-64139

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...