Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ctnetlink: Use netlink policy range checks. Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths. This ensures that netlink core rejects invalid values early and can...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid before version 4.15 and 5.x before version 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack targeting all clients using the proxy through HTTP Range request processing...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: iommu/arm-smmu-v3: Fixed the soft lockup triggered by armsmmumminvalidaterange. When running an SVA case, the following soft lockup is triggered: -------------------------------------------------------------------- watchdog:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: A range check was added for connrspepid in htcconnectservice. I have also identified the following bugs in my fuzzer: - UBSAN: Array index out of bounds in drivers/net/wireless/ath/ath9k/htchst.c:26:51. Index 255 is...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. Some SMB1 write requests were not properly range-checked to ensure that the client had sent enough data to complete the write operation. As a result, the contents of the server’s memory were written to the file or printer, rather than the data provided by the clien...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF: Protection against integer overflows for stack access sizes This patch reintroduces protection against access to stack memory having a negative value. The access size can appear negative due to overflow in its signed integer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmsmac – added a gain range check to wlcPhyiqcalgainparamsnphy. In wlcPhyiqcalgainparamsnphy, add a gain range check to WARN, instead of potentially unsafe access to the tbliqcalgainparamsnphy array. This fix has been...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick, specifically in the code file coders/bmp.c. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values that are outside the range of the type unsigned int. This likely leads to a disruption in the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed the qgroup reserve leaks in cowfilerange. In the buffered write path, the dirty page owns the qgroup reserve until it creates an orderedextent. Therefore, any errors that occur before the orderedextent is created...

Astra Linux – Vulnerability in Zabbix

Zabbix Frontend offers a feature that enables administrators to manage the installation and ensure that only certain IP addresses can access it. This way, no user will be able to access the Zabbix Frontend during maintenance, and sensitive data will be protected from being disclosed. An attacker...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: BPF: Do not use tnumrange for array range checking when dealing with poke descriptors. Hsin-Wei reported a KASAN issue triggered by their BPF runtime fuzzer, which is based on a custom syzkaller: - BUG: KASAN: Out-of-bounds...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The issue with bitmap corruption when using CLOSERANGEUNSHARE in closerange has been fixed. The function copyfdbitmapsnew, old, count is expected to copy the first count/BITSPERLONG bits from old-fullfdsbits and fill the rest wit...

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats()

A flaw was found in PostgreSQL. An object creator can exploit a type confusion vulnerability in the pgrestoreattributestats function. This flaw occurs due to the conflation of range and multirange values, allowing the attacker to execute arbitrary code as the operating system user running the...

kernel: wifi: cfg80211: validate PMSR FTM preamble range

A flaw was found in the cfg80211 component of the Linux kernel's Wi-Fi subsystem. This vulnerability allows the PMSR FTM request parser to accept preamble values outside the defined nl80211 range. An attacker could exploit this by providing malformed input, potentially leading to unexpected syste...

CVE-2024-29943

CVE-2024-29943 Un bug JIT de SpiderMonkey de Pwn2Own : de l'incohérence de plage d'entiers à l'élimination des vérifications de bornes, puis à l'exécution de code arbitraire RCE. Reproduction de CVE-2024-29943 pour Windows, basée sur https://github.com/bjrjk/CVE-2024-29943 Modifications L'exploit...

cve-2021-22146

cve-2021-22146 J'ai trouvé, lors d'un pentest interne, une vulnérabilité sur Elastic ECE. Elasticdump est un PoC pour CVE-2021-22146 permettant de vider la base de données d'Elastic ECE de la version 7.10.0 à 7.13.3. https://www.exploit-db.com/exploits/50152 Collaborateurs : Mario Díaz Caldera...

CVE-2025-24016

CVE-2025-24016 Comment fonctionne cette méthode de détection ? Ce modèle HTTP Nuclei vérifie une URL cible et sa page /app/login pour l'interface web Wazuh, extrait la valeur wazuhVersion avec une expression régulière, et confirme que la page est accessible statut 200 et qu'il s'agit bien d'une...

CVE-2017-7529

CVE-2017-7529 설명 Nginx 0.5.6부터 1.13.2까지의 버전은 nginx range filter 모듈의 정수 오버플로 취약점에 영향을 받으며, 특수하게 조작된 요청으로 인해 잠재적으로 민감한 정보가 유출될 수 있습니다. 출처: https://nvd.nist.gov/vuln/detail/CVE-2017-7529 Nginx + Flask 예제 다른 오픈 소스에서는 이 취약점이 Apache2에서만 그리고 이미지 파일에 대해서만 재현될 수 있다는 정보를 찾을 수 있지만, 이는 사실이 아닙니다. 이 취약점은 Nginx...

safer-eval-cve-CVE-2019-10760

safer-eval-cve-CVE-2019-10760 L'exploit de preuve de concept POC suivant, ciblant safer-eval version 1.3.1 et inférieures, est le premier payload publiquement connu à attaquer cette plage de versions. Contribution Veuillez consulter CONTRIBUTING pour les directives relatives à la contribution à c...