21306 matches found
Astra Linux – Vulnerability in Jetty9
In Eclipse Jetty versions 9.4.0 through 9.4.46, and 10.0.0 through 10.0.9, as well as 11.0.0 through 11.0.9, the parsing of the authority segment of an http scheme URI causes the Jetty HttpURI class to incorrectly detect an invalid input as a hostname. This can lead to failures in a Proxy scenari...
Astra Linux – Vulnerability in libslirp
An invalid pointer initialization issue was discovered in the SLiRP networking implementation of QEMU. The flaw resides in the tftpinput function and can occur when processing an UDP packet that is smaller than the size of the ‘tftpt’ structure. This issue may lead to out-of-bounds read access or...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: net/sched: schtaprio: fixed possible use-after-free issue. syzbot reported a serious crash 1 in nettxaction, which made no sense until we obtained a reproducible example. This example reinstalls the taprio qdisc, but an invali...
Astra Linux – Vulnerability in Tomcat9
Inconsistent interpretation of HTTP requests „HTTP Request/Response Smuggling“ vulnerability in Apache Tomcat due to an invalid chunk extension. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0...
Astra Linux – Vulnerability in Linux
A flaw was discovered in the KVM’s AMD code, responsible for supporting SVM nested virtualization. The flaw occurs during the processing of the VMCB virtual machine control block provided by the L1 guest, which is used to spawn or handle a nested guest L2. Due to improper validation of the “intct...
Astra Linux – Vulnerability in SQLite3
In SQLite 3.30.1, the exprListAppendList function in the window.c file allows attackers to trigger a invalid pointer dereferencing issue, as constant integer values in ORDER BY clauses of window definitions are handled incorrectly...
Astra Linux – Vulnerability in uriparser
A issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba. Spaces used in a string surrounding a domain name can, when ignored, cause invalid DN strings to write a zero-byte into out-of-bounds memory, resulting in a crash. The greatest threat of this vulnerability is to system availability...
Astra Linux – Vulnerability in Linux
A issue was discovered in the drivers/accessibility/speakup/spkttyio.c file within the Linux kernel, as of version 5.9.9. Local attackers on systems with the speakup driver could exploit this to carry out a local denial-of-service attack, identified as CID-d41227544427. This issue arises due to a...
Astra Linux – Vulnerability in Dbus
A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures...
openssl: invalid pointer dereference in CMP server via crafted protectionAlg
A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...
openssl: QUIC server may trigger double free when processing INITIAL packet
A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...
Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension
A flaw was found in Apache Tomcat. A remote attacker could exploit an inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, by sending a specially crafted request with an invalid chunk extension. This vulnerability allows an attacker to manipulate the way HTTP...
firefox: Privilege escalation due to invalid pointer in the Graphics component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to invalid pointer in the Graphics component...
firefox: Privilege escalation due to invalid pointer in the Graphics component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to invalid pointer in the Graphics component...
Malicious code in invalid-polyfill-boundary (npm)
Source: ossf-package-analysis 0fbf998b1c11f6a785806e2ab4f0bbbc4da9a95e803f643a497d41215484a11d The OpenSSF Package Analysis project identified 'invalid-polyfill-boundary' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...
Malicious code in invalid-polyfill-missing (npm)
Source: ossf-package-analysis 295b859cd3be40684c8d7ebb9bc2a3ca4bb969aad8ff1d524948397a3724c444 The OpenSSF Package Analysis project identified 'invalid-polyfill-missing' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...
Malicious code in invalid-dependency (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
Malicious code in invalid-polyfill-boolean (npm)
Source: ossf-package-analysis 494509102be194f3de6962a2ed4e22af22ecab01d9fb1c460b2cf0d93c4e6591 The OpenSSF Package Analysis project identified 'invalid-polyfill-boolean' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...
