Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: smartpqi: Fix for disablemanagedinterrupts The issue with the registration of blk-mq using the module parameter “disablemanagedinterrupts” was corrected. When we disable the default PCIIRQAFFINITY flag, the driver needs ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: pppasync: Limited MRU to 64K. The syzbot triggered a warning 1 in allocpages: WARNONONCEGFP order MAXPAGEORDER, gfp. Willem fixed a similar issue in the commit c0a2a1b0d631 “ppp: limited MRU to 64K”. Apply the same sanity chec...

Astra Linux – Vulnerability in Qemu

QEMU prior to version 8.2.0 has an integer underflow issue, which can lead to a buffer overflow. This occurs due to a TI command, where a transfer length that is not a DMA transfer is processed, and the actual transfer length is shorter than the length of the available FIFO data. This issue arise...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before versions 2.11.7 and 2.12.x, and even before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free of the xmlValidatePopElement function...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel before version 6.6.7, a untrusted VMM could trigger the int80 syscall handling at any given point. This issue is related to the files arch/x86/coco/tdx/tdx.c and arch/x86/mm/memencryptamd.c...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid dividing by 0 in mbupdateavgfragmentsize when the block bitmap is corrupted. The issue arises when the block bitmap is corrupted, and dividing by 0 may occur during this function. To mitigate this risk, it is necessar...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: spi: hisi-sfc-v3xx: Return IRQNone if no interrupts were detected Return IRQNone from the interrupt handler when no interrupt was detected. This is because an empty interrupt will cause a null pointer error. "Unable to handle...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed use-after-free and null-ptr-deref issues in gtpnewlink. The gtplinkops operation structure for the subsystem must be registered after registering the gtpnetops pernet operation structure. Syzkaller encountered a...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed use-after-free and null-ptr-deref issues in gtpgenldumppdp. The gtpnetops pernet operations structure for the subsystem must be registered before registering the generic netlink family. Syzkaller reported a “general...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: crypto: ccp – Fixed null pointer dereference in sevplatformshutdownlocked. The SEV platform device can be shut down with a null pspmaster, for example, by using DEBUGTESTDRIVERREMOVE. This issue was identified using KASAN:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not ASSERT if the newly created subvolume has already been read. BUG There is a syzbot crash, triggered by the ASSERT during subvolume creation: Assertion failed: !anondev, in fs/btrfs/disk-io.c:1319 ----------- kernel...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: spi-fsl-qspi: check return value after calling platformgetresourcebyname This issue could lead to a null-ptr-deref error if platformgetresourcebyname returns NULL. Therefore, we need to check the return value...

Astra Linux – Vulnerability in WebKit2GTK

A use-after-free vulnerability exists in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before version 2.36.8. This vulnerability allows attackers to execute code remotely...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with appropriately crafted file names...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1, directory traversal is allowed if the filenames are passed to it directly...

Astra Linux – Vulnerability in Node.js

Due to the formatting logic of the "console.table" function, it is not safe to allow user-controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". This approach causes prototy...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may return incorrect lengths when applications call r:wsread, causing the buffer to point past the end of the storage allocated for it...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...

Astra Linux – Vulnerability in advancecomp

Advancecomp v2.3 contains a segmentation fault...

Astra Linux – Vulnerability in Apache2

If the Apache HTTP Server 2.4.53 is configured to perform transformations using modsed, especially in contexts where the input to modsed can be very large, modsed may cause excessive memory allocation and trigger an abort...