Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Potential out-of-bounds writes have been prevented in the handleauthsessionkey function. The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes...

CVE-2026-20348

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

CVE-2026-20347

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...

DEBIAN-CVE-2026-20348

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

CVE-2026-20339

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

DEBIAN-CVE-2026-20339

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

CVE-2026-20337

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

CVE-2026-20339 ClamAV PESpin File Format Processing Integer Overflow Vulnerability

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

EUVD-2026-54506

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

CVE-2026-20347

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...

CVE-2026-20337

CVE-2026-20337 concerns ClamAV’s zip archive parser. The issue arises from improper boundary checks for content in zip files during scanning, which can trigger an out-of-bounds write. An unauthenticated, remote attacker could submit a crafted zip file for scanning, potentially causing the ClamAV ...

CVE-2026-20337

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

freerdp security update

2:3.10.3-12.7 - Add codecID checks for CACHEBITMAPV3ORDER CVE-2026-55827 - Fix boundary checks in gdiBitmapDecompress CVE-2026-55827 Resolves: RHEL-194327...

NPM: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

NPM: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks vulnerability discovered by ? in WordPress Npm ip-address versions = 10.1.1, = 10.2.1...

EUVD-2026-52422

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-64296

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker could create a specially crafted directory with malformed name fragments. When the kernel processes this directory, an out-of-bounds read and write can occur, potentially leading to a denial of service or system...

CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

UBUNTU-CVE-2026-64295

In the Linux kernel, the following vulnerability has been resolved: mm: pageext: add count limit to pageextiternext to prevent invalid PFN access The pageext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1955)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1955 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...