Astra Linux – Vulnerability in Samba, Heimdal

A null pointer de-reference was detected in the way the Samba Kerberos server handled the absence of the sname in the TGS-REQ Ticket Granting Server – Request. A authenticated user could exploit this flaw to crash the Samba server...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nvme: Fixed a multipath crash caused by the flush request when blktrace is enabled. The flush request initialized by blkkickflush has a NULL bio. This issue may be addressed during the nvmeendreq operation during io completion...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in Batik of Apache XML Graphics, allowing an attacker to load a URL through the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the “funky chunks” techniques described here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates the chunk extension...

Astra Linux – Vulnerability in python-bottle

Fix the issue before 0.12.20: handling errors during early request binding...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 9.4.0 to 9.4.56, a buffer can be released incorrectly when encountering a gzip error during the inflation of a request body. This can lead to corrupted data and/or inadvertent sharing of data between requests...

Astra Linux – Vulnerability in Twisted

In Twisted Web version 19.10.0, there was an HTTP request splitting vulnerability. When a content-length and a chunked encoding header were provided, the content-length took precedence, and the remaining part of the request body was interpreted as a pipelined request...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “interconnect”: Do not access reqlist while it is being manipulated. The icclock mutex was split into separate icclock and iccbwlock mutexes in 1 to avoid lockdep splats. However, this did not adequately protect access to...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: A UAF bug was fixed in the error path of the probing process. When the driver fails in sndcardregister during the probing phase, it will free the bcd2k-midiouturb before terminating it, which could lead to a UAF bu...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fixed a memory leak in nfcmrvlplaydeferred. Similar to the handling of playdeferred in commit 19cfe912c37b “Bluetooth: btusb: Fixed a memory leak in playdeferred”, we thought a patch might be necessary here as well...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code for a graph page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the sa...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: serial: rp2: Use ‘requestfirmware’ instead of ‘requestfirmwarenowait’. In ‘rp2probe’, the driver registers ‘rp2uartinterrupt’, then calls ‘rp2fwcb’ using ‘requestfirmwarenowait’. If the firmware does not exist, the function simpl...

Astra Linux – Vulnerability in Waitress

In Waitress version 1.4.0, if a proxy server is used in front of Waitress, an attacker may send an invalid request that bypasses the front-end and is parsed differently by Waitress. This could lead to HTTP request smuggling. Specifically, requests containing special whitespace characters in the...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat. In versions of Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95, HTTP trailer headers were not parsed correctly. A trailer header th...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-11710 etc.)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Astra Linux – Vulnerability in libx11

A vulnerability was discovered in libX11. The security flaw arises because the functions in src/InitExt.c of libX11 do not check whether the values provided for the Request, Event, or Error IDs are within the bounds of the arrays to which those functions refer, by using those IDs as array indexes...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211 – Fix for a memory leak in queryregdbfile In the function queryregdbfile, the alpha2 parameter is duplicated using kmemdup and then freed in regdbfwcb. However, requestfirmwarenowait may fail without calling...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.52 and earlier fail to close inbound connections when errors occur during the discarding of the request body, exposing the server to HTTP Request Smuggling attacks...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm: mxsfb: Fixed NULL pointer dereferencing crash during unloading. The mxsfb-crtc.funcs may already be NULL when unloading the driver. In such cases, calling mxsfbirqdisable via drmirquninstall from mxsfbunload leads to a NULL...

Astra Linux – Vulnerability in Flask

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client’s session...