Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098803)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098803 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix side-effect bug in matchchar macro usage The matchchar macro evaluates its characte...

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-78367 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

EUVD-2026-64885

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-78367 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-78367

A macro injection vulnerability in RPM's rpmbuild tarball processing mode allows a remote attacker to achieve arbitrary code execution . The root cause is in the getTarSpec() function (tools/rpmbuild.cc), which passes an attacker-controlled tar member name to rpmExpand() within a %{basename:...} ...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: fixed the potential integer overflow that could occur when shifting an int. The left shift of the 32-bit integer constant 1 is evaluated using 32-bit arithmetic, and then passed as a 64-bit function argument. In cas...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: Codecs: va-macro: Fix for accessing an array out of bounds for an enum type. Accessing enums using integers would result in accessing an array out of bounds on platforms like aarch64, where sizeoflong is 8 compared to the...

Astra Linux – Vulnerability in Nasm

There is an illegal address access in asm/preproc.c function: ismmacro within Netwide Assembler NASM 2.14rc16. This issue may lead to a denial of service due to out-of-bounds array access, as a certain conversion can result in a negative integer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Added the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c. The missing IPSETHASHWITHNET0 macro in ipsethashnetportnet can lead to the use of the incorrect CIDRPOSc for calculating array offsets, which...

Astra Linux – Vulnerability in LibreOffice

There was an improper certificate validation vulnerability in LibreOffice, where the determination of whether a macro was signed by a trusted author was based solely on comparing the serial number and issuer string of the used certificate with those of a trusted certificate. This is insufficient ...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bnxt: Avoid overflow in bnxtgetnvramdirectory. The value of an arithmetic expression may be subject to overflow due to a failure to cast the operands to a larger data type before performing arithmetic operations. A macro was used...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: zynqmpdma: In struct zynqmpdmachan, the descsize data type was fixed. In the zynqmpdmaalloc/freechanresources functions, there is a potential overflow in the following expressions: dmaalloccoherentchan-dev, 2...

Astra Linux – Vulnerability in emacs

In elisp-mode.el of GNU Emacs prior to version 30.1, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion, allowing attackers to execute arbitrary code. This unsafe expansion also occurs if a user...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rx-macro: fixed an issue where accessing an array was done outside the bounds of the array for an enum type. Accessing enums using integers would result in accessing an array outside its bounds on platforms like...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rx-macro: fixed an issue where access to the compander was allowed. The AUX interpolator does not have a compander; therefore, check this before accessing compander data. Without this check, an out-of-bounds access...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint servers. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added. In the affected versions of LibreOffice, a link in a browser using that scheme could contain an embedd...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint servers. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added. In the affected versions of LibreOffice, links using this scheme could be used to invoke internal macr...