Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drbd: Rejects data replies with an out-of-range payload size. The recvdlessread function receives a PDATAREPLY from a peer into the bio of an outstanding read request. The payload length provided by the peer is stored as the...

Astra Linux – Vulnerability in pillow

In Pillow’s PIL.ImageMath.eval before version 9.0.0, it was possible to evaluate arbitrary expressions, including those that used the Python exec method. A lambda expression could also be used...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sysfs: Do not remove an existing directory during update failures When the sysfsupdategroup function is called for a named group, and the createfiles function fails e.g., due to -ENOMEM, the internalcreategroup function calls...

Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox 112, Focus for Android 112,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Release the meshsendcancel command when it is cancelled. The meshsendcancel function queues the pending command with a NULL destroy callback. It is only released after the sendcancel function is executed. A...

Astra Linux – Vulnerability in Redis

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this issue was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have any safety guarantees related to...

Astra Linux – Vulnerability in dcmtk

It was discovered that DCMTK v3.6.9+DEV contains a buffer overflow issue through the component /dcmimgle/diinpxt.h...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SCTP: The comparison of MACs has been fixed to require constant-time operations. To prevent timing attacks, MACs need to be compared in constant-time. Use the appropriate helper function for this purpose...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: libceph: A potential nullptrderef issue has been prevented in cephhandleauthreply. If a message of type CEPHMSGAUTHREPLY contains a zero value for both protocol and result, this is currently not treated as an error. When...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Arenas allocated by discoverarenas or createarenas are not freed on some error paths during bttinit. This leads to memory leakage when BTT initialization fails. Free arenas are called using freearenas from the affecte...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: Serial: Handling of zero-length frames to prevent RX buffer overflow The MCTP serial receive state machine reads the frame length byte in the mctpSerialPushHeader function’s case 2, and validates it as an upper-bound-only...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, releases the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sctp: Validated the length of the embedded INIT chunk and the length of the address list in the cookie. sctpunpackcookie only checks that the length of the embedded INIT chunk does not exceed the remaining cookie payload, but...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: platform/surface: acpi-notify: Check ACPI companion before use Since every platform driver may be forced to match a device that does not match its list of device IDs due to devicematchdriveroverride, platform drivers that rely on...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: cfg80211: Cancel sched scan results work on unregister The cfg80211schedscanresults function can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - In bcmrxsetup, it is now necessary to validate the frame length before installing frames for TXSETUP. - In bcmtxsetup, the frame length cf-len is validated against the DLC limits of CAN/CAN FD. However, bcmrxsetup never...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Net: Bridge – Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative integer, which is converted to an unsigned value when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: Validated the sizes of ACL entries in f2fsaclfromdisk. f2fsaclcount only validates the aggregate ACL xattr length. A malformed ACL can still place ACLUSER or ACLGROUP in a slot that only contains struct f2fsaclentryshort...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fixed corruption of swap entries when clearing uffd-wp during fork. The copyhugetlbpagerange function clears the uffd-wp bit from migration and hwpoison entries using hugepteclearuffdwp, which operates on the...