Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtkpciesetupirq, the IRQ domains are allocated before the controller’s IRQ is retrieved. If this step fails, the function directly returns an error, without...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xsk: The UMEM headroom validation has been improved to account for tailroom and minimum frame size. The current headroom validation in xdpumemreg might result in insufficient space being reserved for receiving Ethernet frames of...

Astra Linux – Vulnerability in Apache2

A properly crafted URI sent to httpd, configured as a forward proxy with ProxyRequests enabled, can cause a crash NULL pointer dereference. In configurations that mix forward and reverse proxy declarations, it can also allow requests to be directed to a declared Unix Domain Socket endpoint...

Astra Linux – Vulnerability in golang-golang-x-net

In net/http in Go, before versions 1.18.6 and 1.19.x, and before version 1.19.1, attackers can cause a denial of service because an HTTP/2 connection may become unresponsive during closure, if the shutdown process is interrupted by a fatal error...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed a NULL pointer bug in svmrangesetattr. The processinfo can be NULL if the user does not call kfdioctlacquirevm before calling kfdioctlsvm. Cherry-picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks When ESN is enabled, AH allocates its temporary auth/ICV layout differently: the async ahash setup appends a 4-byte seqhi slot before the ICV or authdata area, but the async...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10, and Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The raw: section states that the issue with using ro-uniq after its memory was freed has been fixed in rawrcv. The rawrelease function unregisters raw CAN receive filters via canrxunregister. However, the deletion of the receiver...

Astra Linux - Vulnerability in libjdom1-java, libjdom2-java

A XXE vulnerability exists in SAXBuilder in JDOM through version 2.0.6, allowing attackers to cause a denial of service through a crafted HTTP request...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and earlier, a single maliciously crafted HTTP request could block the server’s event loop for an extended period, due to the use of the HTTPHeaders.add method. This method accumulates values using string...

Astra Linux – Vulnerability in connman

A stack-based buffer overflow in dnsproxy in ConnMan prior to version 1.39 could be exploited by network-adjacent attackers to execute malicious code...

Astra Linux – Vulnerability in libwoodstox-java

Those who use Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow. This vulnerability could potentially all...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: Clearing trailing padding in buildpolexpire The buildexpire function clears the trailing padding bytes of the struct xfrmuserexpire after setting the u8 hard field using memsetafter. However, the analogous function...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.72, using the "after free" mechanism in the Network API of Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: lapbether: handling NETDEVPRETYPECHANGE. The lapbethdatatransmit function expects the underlying device type to be ARPHRDETHER. Returning NOTIFYBAD from the lapbethdeviceevent function ensures that the bonding driver cannot...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iouring/tctx: A workaround has been implemented for the allocation error issue with xastore. The syzbot triggered the following WARNON: WARNING: CPU: 0 PID: 16 at iouring/tctx.c:51 iouringfree+0xfa/0x140 iouring/tctx.c:51 The...

Astra Linux – Vulnerability in Chromium

The double-free operation in the ICU of Google Chrome before version 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Apache2

A substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attackers to execute scripts in directories permitted by the configuration, but these directories are not directly accessible via URLs. Additionally, the source of scripts intended for execution only as CG...

Astra Linux – Vulnerability in gst-plugins-ugly1.0

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Networking. The supported versions affected by this vulnerability include Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle...