Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: dm: fixed a NULL pointer race issue when completing IO operations. The dmiodecpending function calls endioacct first, and then decreases the number of pending DMA operations. However, if a task swaps the DM table at the same...

Astra Linux – Vulnerability in WebKit2GTK

Multiple memory corruption issues have been resolved through improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

Improper access control in the IntelR Ethernet Controller RDMA driver for Linux before version 1.9.30 may allow an unauthenticated user to potentially enable privilege escalation via network access...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in macOS Sonoma 14.1, Safari 17.1, iOS 16.7.2, and iPadOS 16.7.2; as well as iOS 17.1 and iPadOS 17.1. Processing web content may result in a denial-of-service condition...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084 – fixed the termination of frequency table arrays. The frequency table arrays should be terminated with an empty element. Add such an entry to the end of the arrays where it is missing, in order to avoid...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not ASSERT if the newly created subvolume has already been read. BUG There is a syzbot crash, triggered by the ASSERT during subvolume creation: Assertion failed: !anondev, in fs/btrfs/disk-io.c:1319 ----------- kernel...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command method. This method constructs shell commands by interpolating user-supplied Perforce connection parameters port, user, client...

Astra Linux – Vulnerability in Firefox

Spoofing issue in the Site Permissions component. This vulnerability has been fixed in Firefox 143 and Thunderbird 143...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: IB/hfi1: Fixed an early init panic issue. An early failure in hfi1ipoibsetuprn can lead to the following panic: BUG: Unable to handle a NULL pointer derefrence in the kernel at 00000000000001b0 PGD 0 P4D 0 Oops: 0002 1 SMP NOP...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrackinsn The verifier skips invalid kfunc calls in checkkfunccall. Such calls would be caught by fixupkfunccall if they aren’t eliminated through dead code elimination. However, this can lead ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: Fixed the issue where clkcoreget could dereference a NULL value. It is possible for clkcoreget to dereference a NULL value in the following sequence: c clkcoreget ofclkgetHWFromClkspec ofclkgetHWFromProvider clkgetHW clkgetH...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: fix bitmap leaks The RX/TX flow-control bitmaps rxfcpfvfbmap and txfcpfvfbmap are allocated by cgxlmacinit, but never freed in cgxlmacexit. Unbinding and rebinding the driver therefore triggers a kmemleak:...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: RMI. The supported versions affected by this vulnerability are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM fo...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipprotsock. sysctlipprotsock is accessed concurrently, and there is always a chance of data races occurring. Therefore, both readers and writers require some basic protection to avoid...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: exynos-ppmu: Fixed a refcount leak in the ofgetdevfreqevents function. The ofgetchildbyname function returns a node pointer with a refcount incremented. We should use ofnodeput on this pointer after execution. This...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Fixed KASAN: slab-out-of-bounds read in fib6nhflushexceptions Reported by syzbot: HEAD commit: 90c911ad Merge tag ‘fixes’ of git://git.kernel.org/pub/scm/… git tree:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: fixed a null pointer dereference in dtInsertEntry Reported by syzbot General protection fault, likely for a non-canonical address 0xdffffc0000000001: 0000 1 PREEMPT SMP KASAN PTI KASAN: nullptrderef in range...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: No longer allows guest users on multi-channel connections. This patch returns STATUSNOTSUPPORTED if the binding session is a guest session...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: High...