Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a deadlock issue when converting an inline directory in nojournal mode. In nojournal mode, ext4finishconvertinlinedir can cause a self-deadlock by calling ext4handledirtydirblock after having already taken the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/sti: The return type of stidvo,hda,hdmiconnectormodevalid has been corrected. With Clang’s Kernel Control Flow Integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer...

Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc., distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component, dockerd, which was originally developed as “moby/moby”, is commonly referred to as Docker. Swarm Mode ...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Immediately reset the MMU context when the SMM flag is cleared The MMU context should be reset immediately when the SMM flag of the vCPU is cleared, so that the SMM flag in the MMU context is always synchronized with th...

Astra Linux – Vulnerability in Chromium

In the Overview Mode of Google Chrome on Chrome OS, before version 104.0.5112.79, a remote attacker who convinced a user to engage in certain user interactions could potentially exploit heap corruption through specific UI interactions...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bonding: Fixed a NULL dereference of the struct bonding.rrtxcounter member. This issue occurs because if a bond is created with an initial mode != zero Round Robin, the memory required for the counter is never allocated. When...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: drm/imx: Fixed a memory leak in imxpdconnectorgetmodes. Avoid leaking the display mode variable if ofgetdrmdisplaymode fails. Addressing-Coverity-ID: 1443943 "Resource leak"...

Astra Linux – Vulnerability in mbedtls

A timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS from version 2.23.0 allows an attacker to obtain secret key information. This issue affects the CBC mode, as it involves a calculated time difference based on the padding length...

Astra Linux – Vulnerability in OpenSSL

AES OCB mode for 32-bit x86 platforms, using the AES-NI assembly-optimized implementation, may not encrypt all of the data under certain circumstances. This could reveal sixteen bytes of data that were already present in the memory but were not written. In the special case of “in-place” encryptio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mt76: fixed the crash in monitor mode with the sdio driver. The mt7921s driver may receive frames with fragment buffers. If a CTS packet is received in monitor mode, the payload is only 10 bytes, and 6 bytes of header padding ...

Astra Linux – Vulnerability in Chromium

In the Overview Mode of Google Chrome on Chrome OS, before version 109.0.5414.74, a remote attacker who convinced a user to perform certain UI interactions could potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

A website can prevent a user from exiting full-screen mode through alerts and prompts. This can lead to user confusion and potential spoofing attacks. This vulnerability affects Firefox versions earlier than 115...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Reading Mode in Google Chrome before version 119.0.6045.105 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through those gestures. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

A malicious website can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscured the fullscreen notification and could have been exploited in a spoofing attack. This vulnerability affects Firefox versions earlier than 119...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Reading Mode in Google Chrome before version 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through specific UI interactions. Chromium security severity: Medium...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True, as well as the truncatewordshtml template filter, are vulnerable to a denial-of-service attack via a crafted regular expression. NOTE: This issue persists due to an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/client: The modes array contains pointers to modes in the connector’s mode lists, which are protected by dev-modeconfig.mutex. Therefore, we need to extend the protection for modes at the same time; otherwise, by the time we...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mt76: mt7915: fixed NULL pointer dereferencing in mt7915getphymode Fixed the NULL pointer dereferencing in mt7915getphymode routine by adding an IBSS interface to the mt7915 driver. 101.137097 wlan0: Triggered a new scan to fi...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, cpumap: Handle skb as well when cleaning up ptrring. The following warning was reported when running xdpredirectcpu with both skbmode and stressmode enabled: ------------ Cut here ------------ Incorrect XDP memory type...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fixed a possible null pointer dereferencing issue. In radeonfpnativemode, the return value of drmmodeduplicate is assigned to mode, which could lead to a NULL pointer dereferencing issue upon failure of...