Astra Linux – Vulnerability in glibc

Using wordexp with WRDEREUSE in conjunction with WRDEAPPEND in the GNU C Library, from version 2.0 to version 2.42, may cause the interface to return uninitialized memory in the wewordv member. This could lead to the process being aborted upon subsequent calls to wordfree...

Astra Linux – Vulnerability in Firefox

When String.toUpperCase caused a string to become longer, it was possible for uninitialized memory to be incorporated into the resulting string. This vulnerability was fixed in Firefox 136 and Thunderbird 136...

Astra Linux – Vulnerability in Firefox, Thunderbird

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2...

Astra Linux – Vulnerability in mbedtls

In Mbed TLS versions prior to 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uninitialized stack memory was used to construct the TLS Finished message. This could potentially lead to authentication bypasses, such as replay attacks...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: misc/vmwvmci: fixed an infoleak in vmcihostdoreceivedatagram The struct vmcieventqp allocated by qpnotifypeer contains padding, which may carry uninitialized data to the user space, as observed by KMSAN: BUG: KMSAN:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fixed an integer overflow in radeoncs parserinit. The type of size is unsigned. If size is 0x40000000, there will be an integer overflow. After size = sizeofuint32t, size will become zero, which may lead to referencin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM – Use kzalloc for SEV ioctl interfaces to prevent kernel data leaks. For some SEV ioctl interfaces, the length parameter passed may be less than or equal to SEVFWBLOBMAXSIZE, but larger than the data returned by the PSP...

Astra Linux – Vulnerability in Firefox

The MarkStack assignment operator, which is part of the JavaScript engine, could access uninitialized memory if it was used in a self-assignment. This vulnerability affects Firefox versions less than 125...

Astra Linux – Vulnerability in Firefox

Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...

Astra Linux – Vulnerability in Thunderbird, Firefox

ANGLE failed to initialize parameters, which resulted in reading from uninitialized memory. This vulnerability could be exploited to leak sensitive data from memory. This issue affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed integer overflow in amdgpucspass1. The type of size is unsigned int. If size is 0x40000000, there will be an integer overflow. After size = sizeofuint32t, size will become zero, which may lead to referencing...

Astra Linux – Vulnerability in Firefox and Thunderbird

Uninitialized memory in a canvas object could have led to an incorrect free operation, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13, and Firefox 91...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: seg6: Fixed validation of nexthop addresses The kernel currently validates that the length of the provided nexthop address does not exceed the specified limit. This could lead to the kernel reading uninitialized memory if the use...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Check the length of skb for an unknown CC opcode. In hcicmdCompleteevt, if the command completion event has an unknown opcode, we assume that the first byte of skb-data contains the return status. However, th...

Astra Linux – Vulnerability in md4c

The mdanalyzeline function in md4c.c, within md4c 0.4.7, allows attackers to trigger the use of uninitialized memory, thereby causing a denial of service through a malformed Markdown document...

CVE-2026-74673

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

CVE-2026-74673 Input: evdev - fix information leak in evdev_pass_values()

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

CVE-2026-74673 Input: evdev - fix information leak in evdev_pass_values()

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

CVE-2026-74673

CVE-2026-74673 is an information leak in the Linux kernel's evdev (event device) input subsystem. In evdev_pass_values(), __evdev_queue_syn_dropped, and __pass_event, the struct input_event is allocated on the kernel stack and populated field-by-field without full initialization. On architectures...

Linux Distros Unpatched Vulnerability : CVE-2026-74673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-fiel...