Astra Linux – Vulnerability in xz-utils

XZ Utils provides a general-purpose data-compression library along with command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, there is a bug in the multithreaded .xz decoder in liblzma: invalid inputs can potentially cause a crash. The effects of this bug include heap usage after deallocation, as...

Astra Linux – Vulnerability in Thunderbird

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used, which could allow a network observer to determine the length of the requested email address. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The listfirstentryornull function was used in opinfogetlist. The listfirstentry macro never returns NULL. If the list is empty, it returns an invalid pointer. Use listfirstentryornull to check whether the list is empty...

Astra Linux – Vulnerability in ansible-core

A flaw was discovered in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections by using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Navigation in Google Chrome before version 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: Unnecessary driverlock has been removed from the setboost function. setboost is a function call per policy; therefore, a driver-wide lock is unnecessary. Additionally, this mutexacquire operation may conflict...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: idxd: The call with idxdcleanup helper has been removed from the refactoring process. The idxdcleanup helper is responsible for cleaning up operations related to perfmon, interrupts, internals, etc. The removal of...

Astra Linux – Vulnerability in Perl

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hns: Fixed a soft lockup that occurred during the loop that allocates BT pages. The driver executes a for-loop when allocating BT pages and mapping them with buffer pages. When allocating a large buffer e.g., an MR of ove...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: decrease cached dst counters in dstrelease The upstream fix ac888d58869b “net: do not delay dstentriesadd in dstrelease” moved the decrementing of the dst counter from dstdestroy to dstrelease to avoid accessing already free...

Astra Linux – Vulnerability in Intel Microcode

An uncaught exception occurred in the core management mechanism for some IntelR processors. This may allow an authenticated user to potentially enable denial of service through local access...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkaller reported a lockdep splat in the PM control path: WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sockownedbyme include/net/sock.h:1711 inline WARNING: CP...

Astra Linux – Vulnerability in Tiff

A memory-related flaw was discovered in libtiff. Passing a specially crafted TIFF file to the TIFFOpen API may allow a remote attacker to cause a denial of service by using a crafted input with a size smaller than 379 KB...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in Skia in Google Chrome before version 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

If a user visited a webpage with an invalid TLS certificate and granted an exception, the webpage was able to present a WebAuthn challenge that the user was prompted to complete. This violates the WebAuthN specification, which requires a secure transport connection without errors. This...

Astra Linux – Vulnerability in grub2

A flaw was discovered in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered them was unloaded, resulting in a use-after-free vulnerabilit...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When performing a symlink lookup, the grub’s UFS module checks the data size of the inode to allocate an internal buffer to read the file content. However, it fails to check whether the data size of the symlink has exceeded its allocated limit. As a result, the...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Node.js

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executed in a background thread, causing the Node.js process to crash. Such cryptographic operations are commonly applied to untrusted inputs. Therefore, this mechanism potentially allows ...