Astra Linux - Vulnerability in golang-1.19

Calling any of the Parse functions on Go source code that contains deeply nested literals can cause a panic due to stack exhaustion...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Fixed the condition in ‘nandselecttarget’. ‘cs’ here must be within the range 0:nanddevntargets...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks whether it has three endpoints, as well as endpoints for bulk in-and-out operations. However, it does not check whether the third endpoint is an interrupt input. Th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf/core: Early exit occurs when perfmmap fails. When perfmmap fails to allocate a buffer, it still invokes the eventmapped callback of the related event. On X86 architecture, this may increase the perfrdpmcallowed reference...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Limit access to parser-buffer when tracegetuser fails. When the length of the string written to setftracefilter exceeds FTRACEBUFFMAX, the following KASAN alarm will be triggered: BUG: KASAN: Slab-out-of-bounds in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211: A use-after-free issue was addressed in the cmpbss function. This issue was introduced due to a quiriness related to the bssfree function introduced in commit 776b3580178f „cfg80211: Properly track hidden SSID...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Do not queue completed sysfs fallback requests. The fwloadsysfsfallback function calls deviceadd before adding fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface; therefore, a userspace...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

When sending malicious data to the kernel using the ioctl cmd FBIOPUTVSCREENINFO, the kernel will write memory beyond its boundaries...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fixed the fwnode leak in v4l2fwnodeparselink. In v4l2fwnodeparselink, the reference to the remote endpoint fwnode is acquired using fwnodegraphgetremoteendpoint. This reference is properly released during erro...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nilfs2: The slab-out-of-bounds issue in nilfsdirectpropagate after truncation has been fixed. Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fixed an underflow issue when using nrseqstate - 1 for initialization or setting TRCSEQEVR, where the number of transitions varies from 0 to 2 when TRCIDR5.NUMSEQSTATE is 0b100; otherwise, TRCIDR5.NUMSEQSTATE is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Power: Supply: bq256xx – Drain usbwork before freeing the charger. The USB-PHY notifier queues usbwork, and the handler of usbwork calls powersupplychangedbq-charger. The devm action only unregisters the notifier, but it was...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: fixed the issue where lost bounce buffers occur when TDs span several ring segments. When a TD reaches a link TRB with data that is not aligned with the endpoint’s wMaxPacketSize, the xhciAligntd function stages the unalign...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: The Zero SFP DMA buffer is not zeroed in FRU/I2C bsg handlers. The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte buffer, which is obtained through dmapoolalloc. This buffer does not zero...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap out-of-bounds read occurred in the smartcard SetAttrib path when cbAttrLen did not match the actual NDR buffer length. This vulnerability has been fixed in version 3.20.1...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK:...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in aom

The file aomdsp/graintable.c in the libaom library within AOMedia, which was available before March 2021, contains a use-after-free vulnerability...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.13.8 and 2.14.x before 2.14.2, there is a issue where xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this vulnerability, a crafted XML document must be validated against an XML schema with certain identity constraints, or a...