Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: rds: Fixed a possible NULL pointer dereferencing issue. In the rdsrdmacmeventhandlercmn function, a check was performed to ensure that the conn pointer exists before dereferencing it as an argument for rdmasetservicetype. Th...

Astra Linux – Vulnerability in Squid

SQUID is vulnerable to HTTP request smuggling, which is caused by the laxity of the chunked decoder. This allows a remote attacker to perform Request/Response smuggling beyond the firewall and frontend security systems...

Astra Linux – Vulnerability in Shadow

A flaw was discovered in shadow-utils. When requesting a new password, shadow-utils asks for the password twice. If the password is incorrect on the second attempt, shadow-utils fails in clearing the buffer used to store the first entry. This may allow an attacker with sufficient access to retrie...

Astra Linux – Vulnerability in Node.js

The generateKeys API function returned by crypto.createDiffieHellman only generates missing or outdated keys. In other words, it only generates a private key if none has been set yet. However, this function is also needed to compute the corresponding public key after calling setPrivateKey...

Astra Linux – Vulnerability in Wireshark

The iSCSI dissector in Wireshark versions 4.0.0 to 4.0.6 allows for denial of service through packet injection or malicious capture files...

Astra Linux – Vulnerability in binutils

The binutils version 2.32 and earlier contains an Integer Overflow vulnerability in objdump, bfdgetdynamicrelocupperbound, and bfdcanonicalizedynamicreloc. This vulnerability can lead to Integer Overflow, which in turn triggers Heap Overflow. Successful exploitation of this vulnerability allows f...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs in Firefox 104 and Firefox ESR 102.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid-tcon before performing network operations. Avoid leaking a reference to tcon when a lease-break operation occurs, especially when opening the cached directory. Processing the lease-break operation might requi...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: Fixed issues with dangling scoconn objects and use-after-free in scosocktimeout. Consecutively connecting the same socket twice in scosockconnect could lead to a race condition, where two scoconn objects are created...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.14 contains a heap buffer overflow vulnerability in the derivespatiallumavectorprediction function at motion.cc...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.72, using "after free" in bookmarks in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Apache2

The Apache HTTP Server versions 2.4.6 to 2.4.46, with the modproxywstunnel module configured, were used to handle a URL request. The origin server did not necessarily upgrade this connection. As a result, subsequent requests using the same connection could be processed without any HTTP validation...

Astra Linux – Vulnerability in Chromium

Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fixed a memory leak when reading the function table. When the input parameter idx matches the expected case option in hinicdbggetfunctable, the readdata variable is not released properly. This issue has been addressed...

Astra Linux – Vulnerability in openimageio

There is a heap-out-of-bounds read vulnerability in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, it relates to the handling of run-length encoded byte spans. A malformed RLA file can lead to an out-of-bounds read of heap metadata, potentially...

Astra Linux – Vulnerability in node-json5

JSON5 is an extension to the popular JSON file format, designed to make it easier to write and maintain manually, especially for configuration files. The parse method in the JSON5 library, as of versions 1.0.1 and 2.2.1, does not restrict the parsing of keys named proto. This allows specially...

Astra Linux – Vulnerability in libinput

A format string vulnerability was detected in libinput...

Astra Linux – Vulnerability in exim4

Exim: Improper Neutralization of Special Elements Leading to Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw resides within the...

Astra Linux – Vulnerability in nss, Thunderbird

Versions of NSS Network Security Services prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications that use NSS to handle signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be affected. Applications that...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free flaw was discovered in fs/ext4/namei.c:dxinsertblock, within the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with user privileges to cause a denial of service...