Astra Linux – Vulnerability in binutils

A vulnerability was discovered in the binutils libbfd.c 2.36 code, related to auxiliary symbol data. Attackers can use this vulnerability to read from or write to system memory, or cause a denial of service...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Set video drvdata before registering the video device. video drvdata should be set before the video device is registered; otherwise, videodrvdata may return NULL in the open file operations, leading to errors...

Astra Linux – Vulnerability in openjpeg2

A heap-based buffer overflow was detected in openjpeg, specifically at line 379:42 in color.c:420 when decompressing a specially crafted .j2k file. An attacker could exploit this vulnerability to execute arbitrary code with the permissions of the application compiled against openjpeg...

Astra Linux – Vulnerability in grub2

When reading data from an HFS filesystem, Grub’s HFS filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffer size. However, it fails to properly check for integer overflows. A maliciously crafted filesystem may cause some of those buffer siz...

Astra Linux – Vulnerability in mongo-c-driver

The bsonstringappend function in the MongoDB C Driver may be vulnerable to a buffer overflow. In this scenario, the function might attempt to allocate a buffer that is too small, which could lead to memory corruption in the neighboring heap memory. This issue affects versions of libbson prior to...

Astra Linux – Vulnerability in grub2

The “read” command is used to read the keyboard input from the user. While reading, the input length is stored as a 32-bit integer value. This value is then used to reallocate the line buffer to accommodate the next character. During this process, if the line is long enough, it’s possible for thi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: pm: fixed the UaF read in mptcppmnlrmaddrorsubflow Syzkaller reported this issue as follows: ================================================================== BUG: KASAN: slab-use-after-free in...

Astra Linux – Vulnerability in WebKit2GTK

A vulnerability related to out-of-bounds reads has been addressed through improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6. Processing maliciously crafted web content...

Astra Linux – Vulnerability in Thunderbird, Firefox

A race condition could allow a cross-origin container to obtain permissions from the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...

Astra Linux – Vulnerability in libxml2

The GNOME project’s libxml2 v2.9.10 has a global buffer over-read vulnerability in the xmlEncodeEntitiesInternal function within libxml2/entities.c. This issue has been fixed in the commit numbered 50f06b3e...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: clk: st: Fixed a memory leak in stofquadfssetup. If stclkregisterquadfspll fails, @lock should be freed before going to @errexit; otherwise, it will cause a memory leak issue. Fix this issue...

Astra Linux – Vulnerability in TeXeVe-Bin

LuaTeX prior to version 1.17.0 allows a document compiled with default settings to make arbitrary network requests. This occurs because full access to the socket library is allowed by default, as stated in the documentation. This also applies to TeX Live prior to version 2023 r66984 and MiKTeX...

Astra Linux – Vulnerability in qpdf

QPDF versions 9.x through 9.1.1, and 10.x through 10.0.4 have a heap-based buffer overflow in the PlASCII85Decoder::write function invoked from PlAESPDF::flush and PlAESPDF::finish when a certain downstream write operation fails...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmvtpmproxy: fixed a race condition in the creation of /dev/vtpmx. The /dev/vtpmx becomes visible before ‘workqueue’ is initialized, which can lead to memory corruption in the worst-case scenario. This issue is addressed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: The issue of out-of-bounds access during the spinorseterasetype function has been fixed. The spinorseterasetype function was used either to set or to mask an erase type. When it was used to mask an erase type, an...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUNRESET handling This fix addresses a bug where the initiator assumes that a LUNRESET has cleaned up running commands, when in fact it hasn’t. The bug was introduced in commit 51ec502a3266 “target:...

Astra Linux – Vulnerability in libxml2

The vulnerability of the xmlBufSetInputBaseCur function in the Libxml2 library is related to the use of memory after it is freed. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed a memory leak in kfdmemdmamapuserptr. If the number of pages from the userptr BO differs from the SG BO, then the allocated memory for the SG table does not get freed before returning – leading to an EINVAL erro...