Exploit for Out-of-bounds Write in Apple Ipados

🛡️ CVE-2026-86950 — CoreGraphics Security Research...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

DEBIAN-CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

CVE-2022-27925

CVE-2022-27925 Descripción El 10 de mayo de 2022, Zimbra publicó las versiones 9.0.0 patch 24 y 8.8.15 patch 31 para abordar múltiples vulnerabilidades en Zimbra Collaboration Suite, incluyendo CVE-2022-27924 sobre la que escribimos anteriormente y CVE-2022-27925. Originalmente, Zimbra denominó a...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Descripción Esta demostración tuvo lugar en HITCON 2023 en Taiwán. La demo destaca la explotación de AMDCpuProfiler.sys dentro de AMD μProf. Al provocar una escritura arbitraria en el token de EPROCESS, se consigue una escalada de privilegios a nivel de SYSTEM...

CVE-2020-17144-EXP

CVE-2020-17144-EXP 条件: Exchange2010; 普通用户 默认用法写webshell: CVE-2020-17144-EXP.exe mail.example.com user pass 执行命令 & 端口复用: 修改ExploitClass.cs 参考 @zcgonvh...

apple-positional-audio-codec-invalid-header

Prueba de concepto para el parche de CoreAudio CVE-2025-31200 en iOS 18.4.1. Artículo aquí https://blog.noahhw.dev/posts/cve-2025-31200/. Actualización 27/05/2025 He logrado llevar esto a una escritura controlada , aunque no arbitraria. El artículo está por venir. Sin embargo, para comprobarlo po...

Astra Linux – Vulnerability in squashfs-tools

The squashfsopendir function in unsquash-2.c within Squashfs-Tools 4.5 enables Directory Traversal, another vulnerability distinct from CVE-2021-40153. A squashfs filesystem that includes a symbolic link, along with files under the same filename, can cause unsquashfs to first create the symbolic...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fixed out-of-bounds read in afe4404read|writeraw KASAN reports an out-of-bounds read as follows: BUG: KASAN: Global out-of-bounds in afe4404readraw+0x2ce/0x380; read of size 4 at address ffffffffc00e4658 by...

Astra Linux – Vulnerability in Paramiko

In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The capacity of the Dirty Page Table is validated during the logreplay copylcns operation. During the analysis phase of the $LogFile journal replay process, logreplay copies LCNs from each action log record into an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: udf: The validation of the sparing table length is performed based on the number of entries, not the number of bytes. The udfloadsparablemap function accepts a sparing table when the condition sizeofst +...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The bound NTFSDEdeview.dataoff was bound in UpdateRecordDataRoot,Allocation. In the UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 functions, the destination of the memmove operation is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: SOF: ipc3-control: Fixed a heap overflow in bytesext put/get The ipccontroldata buffer is allocated using kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata, including its flexible array payload...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Fixed the length checking in receivebig. receivebig limits the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. This limit is still too loose. addrecvbufbig sets sg1 to start at offset sizeofstruct...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: fdp: Bound the device-reported read length and fixed an skb leak. fdpncii2cread takes the next packet length from two bytes provided by the device and does not validate it. This value is used as the count for i2cmasterrec...

Astra Linux – Vulnerability in libfastjson

JSON-C version 0.14 has an integer overflow issue, and there is a risk of out-of-bounds write operations through a large JSON file, as demonstrated by the printbufmemappend function...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the Linux kernel before version 5.19. In the pxa3xxgcuwrite function in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict between sizet and int, which causes an integer overflow and bypasses the size check. Additionally, since this parameter is us...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: sm712fb: Fixed a crash in smtcfbwrite When the sm712fb driver writes three bytes to the framebuffer, the driver crashes. The issue is due to an inability to handle a page fault for the address: ffffc90001ffffff. RIP...