Astra Linux – Vulnerability in snappy-java

Snappy-Java is a Java port of the snappy, a fast C++ compressor/ decompressor developed by Google. It was found that the SnappyInputStream is vulnerable to Denial of Service DoS attacks when decompressing data with a too large chunk size. Due to a lack of a upper bound check on the chunk length, ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed a slab-out-of-bounds Read in dtSearch Currently, when searching for the current page in the sorted entry table of the page, there is an out-of-bound access. A bound check has been added to fix this error. Dave: The...

CVE-2024-29943

CVE-2024-29943 一个 Pwn2Own SpiderMonkey JIT 漏洞：从整数范围不一致到边界检查消除再到 RCE。 基于 https://github.com/bjrjk/CVE-2024-29943 在 Windows 上复现 CVE-2024-29943 修改说明 原漏洞利用代码是针对 Linux 编写的，因此我尝试在 Windows 上复现： 更新了 Windows 下的弹出计算器的 shellcode，并调整了一些堆风水参数。（我尚未完全理解 Windows 堆的工作原理，因此只是调整了一些数值直到稳定。） 使用 Uint8Array 代替 Array...

CVE-2024-29943

CVE-2024-29943 一个Pwn2Own SpiderMonkey JIT漏洞：从整数范围不一致到边界检查消除再到RCE。 该仓库包含了CVE-2024-29943的PoC、Exploit和分析幻灯片。 演示 Demo.mp4 幻灯片 Slides.pdf 复现信息 GitHub Git提交: afbdf6822c9e9f9b6d44b9ea6904cb10878126b1 操作系统: Ubuntu 22.04 架构: amd64 命令行参数: ./js --ion-offthread-compile=off --spectre-mitigations=off PoC.js...

Linux Distros Unpatched Vulnerability : CVE-2026-89630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 cifs: Remove the RFC1002 header from smbhdr changed the quantity this bound ...

Linux Distros Unpatched Vulnerability : CVE-2026-89450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field span...

DEBIAN-CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630

CVE-2026-89630 is a critical vulnerability in the Linux kernel's CIFS/SMB client . A regression introduced by commit 83bfbd0bb902 (which removed the RFC1002 header from smb_hdr) caused the data_offset bound check in is_valid_oplock_break() to evaluate to zero, effectively disabling the overflow g...

CVE-2026-80887

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...

CVE-2026-80887 drm/vmwgfx: use check_add_overflow for shader size+offset bound

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...

CVE-2026-50142

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker can provide a specially crafted HEIF sequence that triggers an unbounded heap allocation. This occurs because the HEIF sequence parser's fixed-size mode is missing a bound check, and an integer...

Astra Linux – Vulnerability in ofono

A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug was triggered within the decodedeliverreport function during SMS decoding. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, or simply through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed an array-index-out-of-bounds read in addmissingindices. stbl is an s8 type, but it must contain offsets into slots that can range from 0 to 127. A bound check was added for this error, and the error -EIO is returned if...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: HID: mcp2221: prevented a buffer overflow in mcpsmbuswrite Slight warning: drivers/hid/hid-mcp2221.c:388 mcpsmbuswrite error: memcpy ‘&mcp-txbuf5’ is too small 59 vs 255 drivers/hid/hid-mcp2221.c:388 mcpsmbuswrite error: memcp...

Astra Linux – Vulnerability in ofono

A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug occurs within the decodedeliver function during SMS decoding. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, or simply through SMS. There i...

Astra Linux – Vulnerability in ofono

A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug occurs within the decodestatusreport function during SMS decoding. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, or simply through SMS...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed an array-index-out-of-bounds issue in dbAdjTree. Currently, there is a missing bounds check when accessing the dmtstree within dbAdjTree. To address this issue, a boolean variable named “isctl” was added. This variable...

CVE-2026-68350

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two, allowing 2 extra iterations past valid txstatus entries when the...