Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server’s validation of XKB key type requests. A local attacker could send a specially crafted request to the X server, leading to a vulnerability where out-of-bounds memory access could occur. This could result in the disclosure of sensitive information or cau...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KEYS: prevented NULL pointer dereference in findasymmetrickey. In findasymmetrickey, if all NULL values are passed as arguments to id0,1,2, the kernel will first emit a WARN message, but then there will be an oops because id2 wil...

Astra Linux – Vulnerability in Thunderbird

An attacker may carry out a DoS attack to prevent a user from sending encrypted emails to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self-signature, and the Thunderbird user imports the crafted key, then Thunderbird may attempt to use the inval...

Astra Linux – Vulnerability in mbedtls

A vulnerability was discovered in Arm Mbed TLS before versions 2.16.6 and 2.7.x, prior to 2.7.15. An attacker who can obtain precise side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinates of the result of scalar multiplication by...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: staticcall: Properly handle module initialization failures in staticcalldelmodule. Module insertion invokes staticcalladdmodule to initialize the static calls within a module. staticcalladdmodule calls staticcallinit, which...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an out-of-bounds write in triegetnextkey The triegetnextkey function allocates a node stack with a size of trie-maxprefixlen. However, it writes trie-maxprefixlen + 1 nodes to the stack when the stack is full, after...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of a null pointer dereference error in generateencryptionkey has been fixed. If a client sends two session setups with KRB5 authentication to ksmbd, a null pointer dereference error in generateencryptionkey can...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtionet: Added a check for hashkeylength. A check for hashkeylength was added in virtnetprobe to avoid possible out-of-bounds errors when setting/read the hash key...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1, Linux-5.10

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections support pairing in Bluetooth Core Specification 4.2 through 5.4. However, these devices are vulnerable to certain man-in-the-middle attacks, which force the use of a short key length. This vulnerability may lead to the...

Astra Linux – Vulnerability in mbedtls

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS from 2.19.1 onwards does not reduce the blinded scalar before computing the inverse. This allows a local attacker to recover the private key through side-channel attacks...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sctp: Handle the error returned from sctpauthasocinitactivekey. When an error is returned from sctpauthasocinitactivekey, the activekey is not actually updated. The old shkey remains freed while it’s still being used as the activ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: Rejects descriptions of keys of type cifs.spnego from the user space. Keys of type cifs.spnego contain fields that carry authority information, such as pid, uid, creduid, and upcalltarget. The cifs.upcall function...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext The key information in wext.connect is not reset upon reconnection, and this can retain data from a previous connection. Resetting the key data prevents drivers or mac80211 from...

Astra Linux – Vulnerability in mbedtls

A vulnerability was discovered in Mbed TLS before versions 2.28.2 and 3.x, prior to 3.3.0. An adversary with access to sufficiently precise information about memory accesses typically, an untrusted operating system attacking a secure environment can retrieve an RSA private key by observing the...

YellowKey-BitLocker-CVE-2026-45585

YellowKey BitLocker YellowKey BitLocker は、BitLocker 回復キーのバックアップと、Windows 10/11 における CVE-2026-45585 の監査を行います。yellowkey github search はここにたどり着きます。管理対象のボリューム向けのポータブル CLI + GUI です。 v2.2 の新機能 2026年9月27日 ボリューム列挙の高速化 CSV/JSON/XML エクスポートのエンコーディング修正 TPM 2.0 PCR サマリー ドメイン参加プロテクター一覧 主な機能...

Security Bulletin: IBM Guardium Key Lifecycle Manager is affected by a security vulnerability (CVE-2026-49844)

Summary Security vulnerability has been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. Th...

CVE-2018-0114

CVE-2018-0114 0.11.0 未満 認証されていないリモート攻撃者が、トークンに埋め込まれたキーを使用して再署名できる可能性があります。 https://www.cvedetails.com/cve/CVE-2018-0114/...

CVE-2026-0073-Android-adbd-authentication-bypass

CVE-2026-0073 に関する調査。開発者ツールとワイヤレスデバッグまたは ADB-over-TCP が有効になっている Android デバイスに、ローカルネットワークアクセスを持つ任意の攻撃者が接続できるようにする認証バイパス。デバイスは事前にペアリング済みである必要がある。 これは Android Studio 上の Android 14 で動作確認済みです。他の環境でも動作するはずですが、悪用可能性は異なる場合があります。 ここでは、サービスを起動してペアリングによりキーを保存するために接続した後、ADB への接続に必要なキーを削除している様子が確認できます。その後は AD...

lehack-2026-challenge

LeHack 2026 チャレンジ 直接ディスクマウントの影響を示す3層構成のチャレンジ。 チャレンジ概要 レベル| 目標| 手法 ---|---|--- 1| 暗号化されていないディスクにアクセスする| grub で起動コマンドラインを init=/bin/bash に設定する 2| vault1 LUKS をクラックする| ヘッダー抽出 → hashcat → ボールトのロック解除 & マウント 3| vault2 LUKS をクラックする| TPM から鍵を読み取る 認証情報 ユーザー| パスワード ---|--- root| SynacktivSekurPasswd1337!...

CVE-2025-65320

CVE-2025-65320 제목 Abacre Restaurant Point of Sale POS의 프로세스 메모리에 민감한 라이선스 자료가 평문으로 저장됨 개요 Abacre Restaurant Point of Sale POS 버전 = 15.0.0.1656에서 소프트웨어 활성화 워크플로 중 민감한 라이선스 데이터가 프로세스 메모리에 평문으로 저장 되는 취약점이 존재합니다. 라이선스 활성화 절차에서 애플리케이션은 특정 시스템에 대해 소프트웨어 설치를 검증하기 위해 장치에 바인딩된 라이선스 키 를 생성하고 처리합니다. 그러나 이러한...