Astra Linux – Vulnerability in symfony

symfony/runtime is a module for the Symphony PHP framework that enables decoupling PHP applications from global state. When the registerargvargc PHP directive is set to on, and users call any URL with a specially crafted query string, they can change the environment or debug mode used by the kern...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: do not free the NULL coalescing rule. If parsing fails, we can dereference a NULL pointer here...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick. This security flaw manifests as undefined behaviors when using double to type as sizet in svg, mvg, and other code segments reoccurring bugs of CVE-2022-32546...

Astra Linux – Vulnerability in Firefox, Thunderbird

In multipart/x-mixed-replace responses, the Content-Disposition: attachment header in the response was not respected, and no download was forced, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: qmiwwan: fix a memory leak for non-IP packets. Free the unused skb objects when no non-IP packets arrive...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find the EFIMEMORYRUNTIME block for the PRM handler and context PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services. The issue arises because PRMT is looking for a block...

Astra Linux – Vulnerability in Git

Git is a fast, scalable, distributed revision control system with a rich set of commands. It offers both high-level operations and full access to its internal workings. When Git requests credentials via a terminal prompt i.e., without using any credential helpers, it prints out the host name for...

Astra Linux – Vulnerability in rsync

A flaw was discovered in rsync. It allows a server to enumerate the contents of an arbitrary file from the client’s machine. This issue occurs when files are being copied from the client to the server. During this process, the rsync server sends checksums of local data to the client for compariso...

Astra Linux – Vulnerability in WebKit2GTK

This issue was addressed through improved state management. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux - Vulnerability in gst-plugins-base1.0

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2readsynchuint function, located in id3v2.c. If id3v2readsynchuint is called with a null work-hdr.framedata, the pointer guint8 data is accessed without validatio...

Astra Linux – Vulnerability in Zabbix

Zabbix allows for the configuration of SMS notifications. AT command injection occurs on the “Zabbix Server” because there is no validation of the “Number” field either on the web interface or on the Zabbix server side. An attacker can send specially crafted phone numbers via SMS and execute...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: sysfs: Prevent division by zero This issue prevents division by zero when monitoring is not enabled...

Astra Linux – Vulnerability in ffmpeg

FFmpeg n6.1.1 has a out-of-bounds read issue through libavcodec/ppc/vp8dspaltivec.c, as shown in the line: static const vecs8 hsubpelfiltersouter...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: be2net: fixed a potential memory leak in bexmit. bexmit returns NETDEVTXOK without freeing the skb variable, in case bexmitenqueue fails. To address this issue, add devkfreeskbany to properly handle the situation...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeuerx We cannot dereference “skb” after calling vcc-push, because the skb is released...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ata: libata-core: Fixed null pointer dereference on error If the ataportalloc call in atahostalloc fails, atahostrelease will be called. However, the code in atahostrelease attempts to free the members of the ataport struct...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: filelock: Fixed the race condition recovery mechanism for fcntl/close operations. When I wrote the commit 3cad1bc01041 “filelock: Remove locks reliably when a race condition is detected with fcntl/close”, I overlooked the fact th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Mark the bpf prog stack with kmsanunpoisonmemory in interpreter mode. syzbot reported uninitialized memory usage during maplookup,deleteelem. ========== BUG: KMSAN: uninitvalue in devmaplookupelem kernel/bpf/devmap.c:441...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: bcm – add an error check in the ahashhmacinit function The ahashinit functions may return errors. The ahashhmacinit function should not return ok when ahashinit returns an error. For example, ahashinit might return -ENOME...