USN-8933-1: RabbitMQ Server vulnerabilities

It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04...

lhccong fish-island-backend server-side request forge vulnerability

The lhccong fish-island-backend has a vulnerability related to server-side request forgeing. This vulnerability stems from the lack of validation on the URL parameters of the GET /api/web/parse interface. It exposes the system to attacks involving server-side request forgeing. Attackers can use...

Tandoor Recipes: Authorization issue vulnerability

Versions of Tandoor Recipes prior to 2.6.10 have an authorization issue vulnerability. This vulnerability arises from processing the/api/recipe-from-source/request. When searching by sequential primary key, there is no restriction on the createdby field. Attackers who are members of shared spaces...

WordPress aThemeArt Theme Helper: Cross-Site Request Forgery Vulnerability

WordPress aThemeArt Theme Helper versions 1.0.8 and earlier have a cross-site request forgeing vulnerability. This vulnerability stems from being vulnerable to cross-site request forgery attacks...

Bitcoinj server request forgery vulnerability

Versions of Bitcoinj prior to 0.17 have a vulnerability related to server-side request forgery. This vulnerability stems from an incorrect operation of the url.openConnection function in the PaymentSession.java file of the Payment Request Handler component. This incorrect operation may lead to...

Portable SDK for UPnP Devices – Digital Error Vulnerability

The Portable SDK for UPnP Devices versions prior to 2.0.2 have a security vulnerability. This vulnerability arises from the rawtoint function in httpparser.c, which truncates or wraps integers when parsing Content-Length headers. This can lead to HTTP requests being injected or causing...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server. This vulnerability, an out-of-bounds read, affects the handling of XKB X Keyboard Extension modifier maps. An attacker with access to the X11 server can exploit this by sending a malformed request, causing the server to read beyond its intended memory...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Rejects non-VALID sessions in the compound request branch. The smb2checkusersession function takes a shortcut for any operation that is not the first in a COMPOUND request. It reuses the work-sess structure the session bou...

Astra Linux – vulnerability in Chromium

Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9fdcancelled Syzkaller reports a KASAN issue as follows: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 1 PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-acce...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: block: do not allow the same type of rqqos to be added more than once During our testing of iocost, we observed some list add/del corruption within the innerwalk list in ioctimerfn. The reason can be explained as follows: cpu 0 c...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: 9p: Setting the refcount to zero was added to avoid uninitialized usage. When a new request is allocated, the refcount will be zero if the request is reused. However, if the request is newly allocated from a slab, it is not...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Verify that report responses match the request It is possible for a malicious or clumsy device to respond to a specific report’s feature request using a completely different report ID. This can cause confusion...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: serial: pch: Fix PCI device refcount leak in pchrequestdma As noted in the pcigetslot comment, it returns a pcidevice with its reference count incremented. The caller must decrement the reference count by calling pcidevput. Since...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Firmware: raspberrypi: fix possible memory leak in rpifirmwareprobe In rpifirmwareprobe, if mboxrequestchannel fails, the ‘fw’ will not be freed via rpifirmwaredelete. To fix this leak, call kfree in the error path...

Astra Linux – Vulnerability in Waitress

Waitress version 1.3.1 allows for the smuggling of requests by sending the Content-Length header twice. Waitress would fold the two Content-Length headers together, and since it cannot convert the now comma-separated values into integers, it internally sets the Content-Length to 0. If two...

Astra Linux - vulnerability in waitress

Waitress version 1.3.1 implemented a “MAY” clause in RFC7230, which states: “Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR.” Unfortunately, if a front-end server does n...

Astra Linux - vulnerability in twisted

In Twisted Web up to version 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request...

Astra Linux – vulnerability in linux-6.1, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfslockandjoinrequests checks whether the request is still attached to the mapping, nothing prevents a call to nfsinoderemoverequest from succeeding until we actually lock the...

Astra Linux – vulnerability in netty

Netty is an asynchronous, event-driven network application framework designed for rapidly developing highly maintainable, high-performance protocol servers and clients. In versions prior to 4.1.71.Final, Netty skips control characters that appear at the beginning or end of a header name. However,...