Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference in the ClonePixelCacheRepository function allowed a remote attacker to cause a denial of service by providing a crafted image file,...

Astra Linux – Vulnerability in Linux 5.10, Linux

A vulnerability has been discovered in the Linux kernel and is classified as problematic. This vulnerability affects the function kcmtxwork in the file net/kcm/kcmsock.c of the kcm component. The vulnerability causes a race condition. It is recommended that a patch be applied to address this issu...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, when a PCD file did not contain a valid Sync marker, the DecodeImage function would get stuck in an infinite loop while searching for the Sync marker. This caused...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when link nums greater than maxlinks Reason The Coverity report indicates an OVERRUN warning. There are only maxlinks elements within dc-links. The number of links can reach...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: nilfs2: Replaces WARNONs with nilfserror in cases where checkpoint acquisition fails. If the creation or finalization of a checkpoint fails due to anomalies in the checkpoint metadata on disk, a kernel warning is generated. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: A divide-by-zero error was avoided in damonlrusortapplyparameters. The patch series “mm/damon: Avoid divide-by-zero in DAMON module’s parameter application”. The RECLAIM and LRUSORT modules of DAMON do not perfo...

Astra Linux – Vulnerability in ModSecurity-Apache

ModSecurity is an open-source, cross-platform Web application firewall WAF engine for Apache, IIS, and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in a specific scenario: when the payload’s content type is application/json, and there is at least one rule that...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fpga: bridge: Added a module owner field and used its pointer to count the reference count of the module. The current implementation of the fpgabridge assumes that the low-level module registers a driver for the parent device...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: TCP: Added sanity tests to TCPQUEUESEQ Qingyu Li reported a syzkaller bug where the repro function changed the RCV SEQ after restoring data in the receive queue. mprotect0x4aa000, 12288, PROTREAD = 0 mmap0x1ffff000, 4096, PROTNON...

Astra Linux – Vulnerability in RustC

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::removedirall standard library function is vulnerable due to a race condition that enables symlink creation...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: tunnels: Annotations were added for lockless accesses to dev-neededheadroom. IP tunnels can apparently update dev-neededheadroom during their xmit path. This patch addresses issues related to three types of tunnels xmit, ...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web would process the requests asynchronously, without guaranteeing the order of responses. If either of the endpoints was controlled by an...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug’s multipart form data parser would parse an unlimited number of parts, including file parts. These parts could be small amounts of data, but each part requires CPU time to parse, and may consume more memory...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. Before version 22.2.0, Twisted’s SSH client and server implementations allowed accepting an infinite amount of data for the peer’s SSH version identifier. This resulted in a buffer that consumed all...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will invoke the dotruncate routine, resulting in an uninitialized runlock error reported by syzbo...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check whether more than chunksize bytes are written. An incorrectly formatted chunk may be decompressed into more than LZNTCHUNKSIZE bytes, resulting in an out-of-bounds index in smaxoff...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Now treats platformmax consistently as a control value. This change is reflected in commit 9bdd10d57a88 “ASoC: ops: Shifted test values in sndsocputvolsw by +min”, and some additional related updates have been made...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 contains SAUCE patches that may involve the use of an uninitialized variable in the AppArmor AFINET/AFINET6 socket mediation code. This bug can be triggered by a non-privileged local user, and it could lead to incorrect, fine-grained mediation of network sockets...

Astra Linux – Vulnerability in binutils

A critical vulnerability was discovered in GNU Binutils 2.43. This vulnerability affects the function bfdelfgcmarkrsec in the file bfd/elflink.c of the ld component. Manipulation of this function leads to memory corruption. The attack can be initiated remotely. The complexity of the attack is qui...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ethtool: Do not perform operations on net devices that are not yet registered. There is a short period between when a net device starts to be unregistered and when it is actually removed from the list of available devices. During...