Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 does not treat the Cookie HTTP header specially or provides any helpers for managing cookies over HTTP; that responsibility lies with the user. However, it is possible for a user to specify a Cookie header, and information may be...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page...

Astra Linux – Vulnerability in pillow

A issue was discovered in Pillow before version 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop during loading...

Astra Linux – Vulnerability in hdf5

A memory leak in the H5Ochunkdeserialize function within H5Ocache.c, part of the HDF HDF5 library, from version 1.10.3 allows attackers to cause a denial of service due to excessive memory consumption through an exploitable HDF5 file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: jbd2: Fixed integer underflow in jbd2journalinitializefastcommit. jbd2journalinitializefastcommit validates the journal capacity by checking whether journal-jlast - numfcblks JBD2MINJOURNALBLOCKS. Both jlast and numfcblks are...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afs: Fixed the callback service message parsers to pass through -EAGAIN. The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fixed a potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed during subsequent error paths. This issue was addressed by calling...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The function regulatorlocktwo should check for EDEADLK instead of EDEADLOCK. This is because -EDEADLK is what wwmutexlock actually returns, and it’s also the value that all other deadlock checks in this file use. The function...

Astra Linux – Vulnerability in Squid

SQUID is vulnerable to HTTP request smuggling, which is caused by the laxity of the chunked decoder. This allows a remote attacker to perform Request/Response smuggling beyond the firewall and frontend security systems...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed the issue of reading strings from synthetic events. The following commands caused a crash: cd /sys/kernel/tracing echo 's:open char file' dynamicevents echo...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during the connect process. frwrwpcreate creates a singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. In case of failure, a negative errno is...

Astra Linux – Vulnerability in exiv2

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A assertion failure occurs when Exiv2 is used to modify the metadata of a specially crafted image file. An attacker could potentially exploit this vulnerability to cause a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Block: Prevent division by zero in blkrqstatsum The expression dst-nrsamples + src-nrsamples may have a value of zero during overflow. It is necessary to add a check to avoid division by zero. This issue was identified by the Lin...

Astra Linux – Vulnerability in Chromium

Type Confusion in XML within Google Chrome before version 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted XML file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: Fixed the issue of NULL pointer dereferencing for a console without vcdata. The function fbconnewmodelist is called when the modelist of a framebuffer changes. For each console mapped to it using fbdisplayi.mode, it reads...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

Astra Linux – Vulnerability in Firefox and Thunderbird

A missing delay in popup notifications could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.32 does not prevent the use of insecure non-multi options in clone and clonefrom commands. NOTE: This issue exists due to an incomplete fix for CVE-2022-24439...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275 – Prevent reading uninitialized stack memory. While adding support for the ROHM BD127X0 hot-swap controllers, Sashiko reported an error in the device-name comparison process, which could lead to reading uninitializ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: libsas: Fixed a deadlock during HA resume and a race condition involving hisisas diskwake. The commit fbefe22811c3 “scsi: libsas: Do not always drain the event workqueue for HA resume” introduced sasresumehanosync to avo...