Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 142.0.7444.59, policy bypass in Extensions allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data through a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fixed locking issues for runtime updates of bcmop. The commit c2aba69d0c36 “can: bcm: added locking for runtime updates of bcmop” added locking for certain variables that can be modified during runtime when updating the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: A signed comparison in iopollgetownership was fixed. iopollgetownership uses a signed comparison to check whether pollrefs has reached the threshold for the slowpath: c if unlikelyatomicread&req-pollrefs =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nflog: The validation of the MAC header was performed before dumping it. The fallback path of dumpmacheader only guards access to the MAC header when skb-macheader != skb-networkheader, without checking...

Astra Linux – Vulnerability in Chromium

Using use after free in ServiceWorkers in Google Chrome before version 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fixed a refcount underflow in intelengineparkheartbeat. A use-after-free or refcount underflow may occur when the heartbeat worker and intelengineparkheartbeat race to release the same engine-heartbeat.systole reques...

Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with modxml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in digital credentials in Google Chrome before version 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: JGSS. The supported versions affected by this vulnerability are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, there was a race in the serial channel IRP thread tracking that allowed for a heap use-after-free condition, where one thread removed an entry from serial-IrpThreads while another read it. This vulnerability...

Astra Linux – Vulnerability in Apache2

A privilege escalation bug in various modules of Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. Users are recommended to upgrade to version 2.4.67, which fixes this issue...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: imxsckey – fixed memory corruption upon unloading. It should be labeled as “priv”, but we accidentally passed “&priv”, which is an address in the stack. This can lead to memory corruption when the imxsckeyaction function i...

Astra Linux – Vulnerability in Apache2

The “Use After Free” vulnerability in the Apache HTTP Server module modhttp2 occurs when file handles are already exhausted. This issue affects Apache HTTP Server versions 2.4.55 through 2.4.67...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Atacade: Ahci: Matching EMMAXSLOTS with SATAPMPMAXPORTS UBSAN reports an array-index-out-of-bounds issue: 1.980703 Kernel: UBSAN: Array-index out of bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41 1.980709...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not cause an overflow during division for dirty tracking. If pgshift is 63, then BITSPERTYPEbitmap-bitmap pgsize will result in an overflow to 0, which can trigger a division by zero. In this case, the index should...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: netpoll: Fix incorrect refcount handling causing improper cleanup The commit efa95b01da18 “netpoll: fix use after free” incorrectly ignored the refcount and prematurely set dev-npinfo to NULL during netpoll cleanup,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/server: A possible reference count leak in smb2sesssetup has been fixed. The reference count of ksmbdsession will leak when the session needs to be reconnected. This issue has been fixed by adding the missing...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: added a bounds check in the putuser loop for DSP events. In the DSP event handling code, the putuser loop copies event data. When the user buffer size is not aligned to 4 bytes, it may overwrite data beyond t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: NFS: Automounted file systems should inherit the “ro”, “noexec”, “nodev”, and “sync” flags. When a file system is automatically mounted, it needs to preserve the user-set superblock mount options, such as the “ro” flag...