Astra Linux – vulnerability in libheif

Libheif is a decoder and encoder for HEIF and AVIF file formats. Versions 1.21.2 and earlier contain a heap buffer over-read in HeifPixelImage::overlay within libheif/pixelimage.cc. When compositing an overlay image iovl where the child image has a different bit depth for the alpha channel compar...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrackirc: fix possible out-of-bounds read When parsing fails after we’ve matched the command string, we should bail out instead of trying to match a different command. This helper should be deprecated; given the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dumpone path The SCTP exact sockdiag lookup can hold a transport reference, block on locksocksk, and then resume after sctpassociationfree has marked the association dead and freed its bin...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRPRSP sense copy by the received length srpprocessrsp copies sense data from rsp-data + respdatalen, where respdatalen is the full 32-bit value supplied by the SRP target and is never checked against the number o...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compatmtwfromuser Luxiao Xu says: The function compatmtwfromuser converts ebtables extensions from 32-bit user structures to kernel native structures. However, it lacks proper validation of th...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb that uses the anchor pattern, it must be anchored prior to submission; otherwise, it may be leaked if usbkillanchoredurbs is called. This...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.28.0, FreeRDP server implementations that enabled the MS-RDPECAM camera device enumerator channel scanned attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Starting from version 3.21.0 up to but including version 3.28.0, FreeRDP clients utilizing the GFX pipeline include an incomplete fix for CVE-2026-23530 in planardecompressplanerleonly within libfreerdp/codec/planar.c. This allows a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection must retain bnepsessionsem while reading dev-name, just as bnepgetconnlist does; otherwise the bnepsession thread may concurrently free the netdevice, which could be...

Astra Linux – vulnerability in gnutls28

A flaw in GnuTLS’s DTLS handshake parsing allows malformed fragments with zero length and non-zero offset. This leads to an integer underflow during reassembly, resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix use-after-free by using callrcu for oplockinfo Currently, ksmbd frees oplockinfo immediately using kfree, even though it is accessed under RCU read-side critical sections in functions such as opinfoget and procshowfile...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fsinodeinfo in f2fsfreedic The decompressioctx may be released asynchronously after I/O completion. If this file is deleted immediately after reading, and the kworker responsible for processing...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs: set dummy blocksize to read bootblock when mounting During mounting, sb-sblocksize is used to read the bootblock without being defined or validated. Set a dummy blocksize before attempting to read the bootblock. The issue c...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusbwork maps the number of active SCO links to USB alternate settings via a three-entry lookup table when CVSD traffic uses transparent voice settings. Currently, the lookup...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DMA-safe memory for spiread Add a DMA-safe buffer and use it for spiread instead of stack memory. All SPI buffers must be DMA-safe. Since we only need up to 3 bytes, we simply use a u8 instead of be16...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, an off by one error in the meta encoder could lead to an out-of-bounds read of a single byte within the meta encoder. This issue has been fixed in versions...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamp NEXIO datalen/xlen to the URB buffer size nexioreaddata extracts datalen and xlen from a packed be16 header within the device’s interrupt packet; it then iterates through packet-data0..xlen and...