Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: Handle the cleanup after a zerocopy send occurs, before the message is queued. A zerocopy send can fail after user pages have been pinned, but before the message is attached to the sending socket. The purge path currentl...

Astra Linux – Vulnerability in liblivemedia

Live555 version 1.08 has a memory leak in the AC3AudioStreamParser for AC3 files...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: Refresh the network header after handling the HAO option. The function ip6parsetlv caches the skbnetworkheaderskb in the network header during the processing of IPv6 TLVs. The function ipv6desthao may call...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes Commit 25e5cb780e62 “nvme-tcp: fix possible crash in writezeroes processing” determined that blkrqpayloadbytes must not be read without first checking blkrqnrphyssegments...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up sidomain in the initdmars error path A splat from kmemcachedestroy was observed in a previous version of the kernel commit ee2653bbe89d, “iommu/vt-d: Remove domain and devinfo mempool” when there was a failur...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net: batman-adv: fix error handling Syzbot reported an ODEBUG warning in batadvncmeshfree. The problem lay in incorrect error handling in batadvmeshinit. Before this patch, batadvmeshinit would call batadvmeshfree in case any...

Astra Linux – Vulnerability in WebKit2GTK

A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6. Processing maliciously crafted web content may lead to an...

Astra Linux – Vulnerability in libstb

STBVorbis is a single-file library licensed under the MIT license, designed for processing OGG Vorbis files. A properly crafted file may trigger an out-of-bounds read in the DECODE macro when var is negative. As can be seen in the definition of DECODERAW, a negative value for var is still a valid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: smartpqi: Fixed a memory leak in pqireportphysluns The pqireportphysluns function fails to release the rpllist buffer when encountering an unsupported data format or when the allocation for rpl16bytewwidlist fails. These...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: The MR restrack must be released when it is deleted. The MR restrack also needs to be released when it is deleted; otherwise, a memory leak may occur, as the task struct will not be released...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Follow the approach used in other DMA-enabled MMC host drivers see host/mmci.c, and limit the maximum segment size based on the capabilities of the DMA engine. This is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: a potential memory leak has been fixed in ext4fcrecordmodified inode. Since krealloc may return NULL, in this case, state-fcmodifiedinodes may not be freed by krealloc. However, state-fcmodifiedinodes is already set to NULL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hns: Fixed the issue where the CPU got stuck due to printouts during reset. During reset, commands to destroy resources such as qp, cq, and mr may fail, and error logs will be printed. When a large number of resources are...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: A memory leak was fixed in btrfsdoencodedwrite. Local fuzzing of version 6.12.94 identified the following memory leak: - Unreferenced object 0xffff888018050a80 size 64: - comm "syz.0.17", pid 10297, jiffies 4294953601 -...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: net: caif: fixed a memory leak in caifdevicenotify In the event of a failure in caifenrolldev, the allocated linksupport will not be assigned to the corresponding structure. Therefore, simply free the allocated pointer in case of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hfi1: Free RX data in case of a late probe failure. The hfi1initdd function allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice fails later, initone destroys the device data...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In emulationprochandler of armv8deprecated.c, there is a potential way to corrupt memory due to a race condition. This could lead to a local escalation of privileges without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android. Versions...

Astra Linux – Vulnerability in Chromium

Before version 150.0.7871.46, read and write operations in Tint using Google Chrome allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Apache2

If the Apache HTTP Server 2.4.53 is configured to perform transformations using modsed, especially in contexts where the input to modsed can be very large, modsed may cause excessive memory allocation and trigger an abort...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: A memory leak was avoided in the magicmousereportfixup function. The magicmousereportfixup function returned a buffer that was allocated using kmemdup. However, this buffer was never freed. The caller of...