Astra Linux – Vulnerability in underscore

The package underscore from 1.13.0-0 and before 1.13.0-2, as well as from 1.3.2 and before 1.12.1, are vulnerable to Arbitrary Code Injection via the template function, especially when a variable property is passed as an argument without proper sanitization...

Astra Linux – Vulnerability in Node-Elliptic

The Elliptic package 6.5.7 for Node.js, in its ECDSA implementation, does not correctly verify valid signatures when the hash contains at least four leading 0 bytes, and when the order of the elliptic curve’s base point is smaller than the hash, due to an truncateToN anomaly. This results in vali...

Astra Linux – Vulnerability in Perl

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions via HTTPS...

ROOT-APP-PYPI-CVE-2023-28370 CVE-2023-28370 in tornado - Patched by Root

Root has patched CVE-2023-28370 in the tornado package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-78CV-MQJ4-43F7 GHSA-78cv-mqj4-43f7 in tornado - Patched by Root

Root has patched GHSA-78cv-mqj4-43f7 in the tornado package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-W235-7P84-XX57 GHSA-w235-7p84-xx57 in tornado - Patched by Root

Root has patched GHSA-w235-7p84-xx57 in the tornado package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-46338 CVE-2026-46338 in pymdown-extensions - Patched by Root

Root has patched CVE-2026-46338 in the pymdown-extensions package for Root:PyPI. Multiple fixed versions available...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

ROOT-OS-DEBIAN-12-CVE-2023-39616 CVE-2023-39616 in aom - Patched by Root

Root has patched CVE-2023-39616 in the aom package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2023-42465 CVE-2023-42465 in sudo - Patched by Root

Root has patched CVE-2023-42465 in the sudo package for Root:Debian:11. Multiple fixed versions available...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a buffer overflow vulnerability due to the long server ID option in DHCPv6 clients. This vulnerability can be exploited by an attacker to gain unauthorized access and may result in a loss of confidentiality, integrity, and/or availability...

Astra Linux – Vulnerability in rpm

A flaw was discovered in the RPM package’s read functionality. This flaw allows an attacker to persuade a victim to install a seemingly verifiable package, or to compromise an RPM repository, thereby causing corruption of the RPM database. The most significant threat posed by this vulnerability i...

Astra Linux – Vulnerability in rpm

A flaw was discovered in RPM’s signature check functionality when reading a package file. This flaw allows an attacker who can persuade a victim to install a seemingly verifiable package, whose signature header was modified, to cause corruption of the RPM database and execute malicious code. The...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of availability...

Astra Linux – Vulnerability in dojo

All versions of the dojo package are vulnerable to Prototype Pollution through the setObject function...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method. This vulnerability occurs when the $sourceReference parameter is appended to a shell command without proper escaping...

Astra Linux – Vulnerability in advancecomp

A segmentation fault flaw was detected in the Advancecomp package. This may result in reduced availability...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in OpenSC. This security flaw causes a buffer overflow vulnerability in the cardoshaveverifyrcpackage function. An attacker can provide a smart card package with malformed ASN1 data. The cardoshaveverifyrcpackage function scans the ASN1 buffer for two tags, but the...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...