Astra Linux – Vulnerability in Mariadb 10.3

MariaDB Server versions 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. may sometimes crash when the backtrace log is empty. This may be related to the makeaggrtablesinfo and optimizestage2 functions...

Astra Linux – Vulnerability in Zabbix

The front-end audit log allows viewing of unprotected plaintext passwords, where the passwords are displayed in plain text...

Astra Linux – Vulnerability in Ansible

Ansible versions 2.9.x before 2.9.1, 2.8.x before 2.8.7, and 2.7.x before 2.7.15 do not respect the “nolog” flag set to True when using Sumologic and Splunk callback plugins to send task result events to collectors. This could lead to the disclosure and collection of sensitive data...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move the cfglogverbose check before calling lpfcdmpdbg In an attempt to log message 0126 using LOGTRACEEVENT, the following hard lockup occurred, causing the system to hang. Call Trace: rawspinlockirqsave+0x32/0x40...

Astra Linux – Vulnerability in Thunderbird, Firefox

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log did not account for external URLs. As a result, data could potentially be exfiltrated from the browser. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Astra Linux – Vulnerability in Linux 5.15

The following vulnerability has been resolved in the Linux kernel: btrfs: fixed an issue with the tree mod log handling of reallocated nodes. We have observed the following panics in production: - Kernel bug at fs/btrfs/tree-mod-log.c:677! - Invalid opcode: 0000 1 SMP - RIP:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: Fixed a null pointer dereference in the tracingerrlogopen function. This issue occurs when the function does not call seqopen if the file is opened only with write permissions. As a result, file-privatedata remains...

Astra Linux – Vulnerability in sudo

Before version 1.9.13, Sudo did not escape control characters in log messages...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid infinite loops when trying to resize the local TT. If the MTU of one of the attached interfaces becomes too small to transmit the local translation table, then it must be resized to fit within all fragments when...

Astra Linux – Vulnerability in Linux 5.15

A use-after-free flaw was discovered in the Linux kernel, specifically in the logreplay function within fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and causes a kernel information leak...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed an out-of-bounds access in rpage. When PAGESIZE is 64K, if logreadrst calls readlogpage for the first time, the size of buffer will be equal to DefaultLogPageSize4K. However, for buffer operations like memcpy, if...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB Server before version 10.7 is vulnerable to Denial of Service attacks. During the execution of the plugin/serveraudit/serveraudit.c method logstatementex, the held lock lockbigbuffer is not released properly, allowing local users to trigger a Denial of Service attack due to a deadlock...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fixed a NULL pointer dereferencing in gfs2logFlush. In gfs2jindexfree, sdp-sdjdesc was set to NULL under the log flush lock to prevent dereferencing of sdp-sdjdesc during gfs2logFlush. In gfs2logFlush, it was checked whethe...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fixed an issue where invalid address access occurred when enabling the SCAN log level. The variable i is changed when setting a random MAC address, causing invalid address access when printing the value of...

Astra Linux – Vulnerability in assimp

A vulnerability exists in assimp v.5.4.3, allowing a local attacker to execute arbitrary code through the CallbackToLogRedirector function within the Assimp library...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Skipping the “reserved bytes” warning after unmounting after a log cleanup failure. After the recent changes made by commit c2e39305299f01 “btrfs: clearing the extent buffer when writing fails” and its follow-up fix,...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allowed execution with unnecessary privileges. Since Exim operates as root in the log directory which is owned by a non-root user, a symlink or hard link attack could allow overwriting of critical root-owned files anywhere in the filesystem...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: nilfs2: Fixed state management in the error path of the log writing function. After the commit a694291a6211 “nilfs2: separate the wait function from nilfssegctorwrite” was applied, the log writing function...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: Nilfs2: Fixed a hang issue in nilfslookupdirtydatabuffers. Syzbot reported a hang issue in migratepagesbatch, called by mbind, and nilfslookupdirtydatabuffers, called in the log writer of nilfs2. While migratepagesbatch locks ...

Astra Linux – Vulnerability in PHP 8.1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, and 8.3. before 8.3.12, when using PHP-FPM SAPI and the option catchworkersoutput is set to yes, it is possible to manipulate the log messages by removing up to 4 characters from the log messages. Additionally, if PHP-FPM is configured to us...