Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fixed truncation for block sizes greater than or equal to 4GB. When the iommu is used, the linearization of the mapping may result in a single block being split across multiple SG entries. When rdmablockiternext...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fixed potential OOB array access during cache reading. The findcontrol function, which retrieves cached information, accesses the array with the given index blindly, which may lead to an OOB array access. A sanity...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: misc: fastrpc: Do not remove the map from createprocess and devicerelease. Do not remove the map from the list during the error handling in fastrpcinitcreateprocess. Instead, call fastrpcmapput to avoid a use-after-free...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of printing in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The can: bcm code allows for the deferring of the rxop deallocation to the workqueue to fix a thrtimer UAF. The commit f1b4e32aca08 “can: bcm: use callrcu instead of the costly synchronizercu” replaces the synchronizercu in...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Accessibility in Google Chrome before version 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in python-ldap

Python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5, the ldap.dn.escapednchars function incorrectly escaped \x00 by emitting a slash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this functi...

Astra Linux – Vulnerability in Chromium

A bug in the object lifecycle mechanism in Dawn, prior to version 149.0.7827.53, allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Mariadb 10.3

It was discovered that MariaDB versions from 10.2 to 10.6.1 contain a segmentation fault due to the Itemsubselect::initexprcachetracker component...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netsched: The gsoskb list is also flushed during the -change operation. Previously, when reducing the limit of a qdisc using the -change operation, only the main skb queue was trimmed, potentially leaving packets in the gsoskb...

Astra Linux – Vulnerability in mbedtls

Mbed TLS versions before 3.0.1 have a double-free error under certain out-of-memory conditions, as demonstrated by a failure in the mbedtlssslsetsession function...

Astra Linux – Vulnerability in libjpeg-turbo

Libjpeg-turbo 1.5.2 has a NULL Pointer Dereference issue in files jdpostct.c and jquant1.c, due to a malicious JPEG file...

Astra Linux – Vulnerability in Firefox

The return value from gfx::SourceSurfaceSkia::Map wasn’t verified, which could potentially lead to a null pointer dereferencing. This vulnerability affects Firefox versions less than 110...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: A potential dereference issue with RCU resources has been fixed in the wilcparsejoinbssparam function. In the wilcparsejoinbssparam function, the TSF field of the ies structure is accessed after the RCU read-side...

Astra Linux – Vulnerability in dovecot

The ManageSieve AUTHENTICATE command crashes when using “literal” as the initial response to SASL. This can be used to repeatedly crash the ManageSieve service, rendering it unavailable to other users. It’s recommended to control access to the ManageSieve port or disable the service if it’s not...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Net: Bridge: mcast: Fixed an issue where a use-after-free occurred with the multicast context of a master VLAN. The brmulticasttoggleonevlan function clears the BRVLFLAGMCASTENABLED flag under the br-multicastlock before...

Astra Linux – Vulnerability in assimp

A vulnerability exists in assimp v.5.4.3, allowing a local attacker to execute arbitrary code through the CallbackToLogRedirector function within the Assimp library...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

The Linux kernel before version 6.2.9 has a race condition, which can lead to a use-after-free issue in the driver/power/supply/da9150-charger.c file. This issue occurs when a physically nearby attacker disconnects a device...