Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2compoundop If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, checkwsleas returns success without validating whether the entire...

Astra Linux – vulnerability in ffmpeg

An out-of-bounds read in the readglobalparam function libavcodec/av1dec.c within FFmpeg v8.0.1 enables attackers to trigger a Denial of Service DoS condition by providing specially crafted input...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smblazyparentleasebreakclose The opinfo pointer obtained via rcudereferencefp-fopinfo is accessed after rcureadunlock has been called. This creates a race condition wherein memory may be freed by a...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in inetlookupestablished The ehash table lookups are lockless and rely on SLABTYPESAFEBYRCU to guarantee socket memory stability during RCU read-side critical sections. Both tcpprot and tcpv6prot ha...

Astra Linux – vulnerability in xrdp

xrdp is an open source RDP server. Versions up to 0.10.5 contain a out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted packet sequence during the initial connection phase. The...

Astra Linux – vulnerability in jq

jq is a command-line JSON processor. In commits prior to 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jvparsesized API in libjq accepts a counted buffer with an explicit length parameter. However, its error-handling path formats the input buffer using %s in jvstringfmt, which reads until a NUL...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 “RDMA/rxe: Validate pad and ICRC before payloadsize in rxercv”, a single unauthenticated UDP packet can still trigger a panic. That...

Astra Linux – vulnerability in gst-plugins-bad1.0

A out-of-bounds read vulnerability was found in the VA JPEG decoder within GStreamer’s gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file,...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAPINFORSP payload length before access The l2capinformationrsp function checks whether cmdlen exceeds the fixed l2capinforsp header type + result, 4 bytes, but then reads rsp-data without verifying...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops Why & How All record-chain walk loops in biosparser.c and biosparser2.c use for;; and only terminate on a 0xFF recordtype sentinel or zero recordsize. A malformed VBIOS image...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs Why & How dpsdpmessagedebugfswrite dereferences connector-base.state-crtc without checking for NULL. A connector can be connected but not bound to any CRTC e.g.,...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size Why & How During HDCP 2.x repeater authentication over HDMI, the driver reads the sink’s RxStatus register and extracts a 10-bit message size field max value 1023. Th...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid bitfield RMW for claim/retune flags Move claimed and retune control flags out of the bitfield word to avoid unrelated RMW side effects in asynchronous contexts. The host-claimed bit shared a word with retune flag...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: sched: actcsum: validate nested VLAN headers tcfcsumact walks through nested VLAN headers directly from skb-data when an skb still contains in-payload VLAN tags. The current code reads vlan-hvlanencapsulatedproto and then...

Astra Linux – vulnerability in libarchive

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2capecreddatarcv l2capecreddatarcv reads the SDU length field from skb-data using getunalignedle16 without first verifying that skb contains at least...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: bridge: brndsend: linearize skb before parsing ND options brndsend parses neighbor discovery options from ns-opt and assumes that these options are in the linear part of the request. Its callers only guarantee that the ICMPv6...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: fix inline data read failure for ztailpacking pclusters Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, zerofsdecompresspcluster may assume they are alread...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: hamradio: 6pack: fix uninit-value in sixpackreceivebuf sixpackreceivebuf fails to properly skip bytes containing TTY error flags. The while loop iterates through the flags buffer but never advances the data pointer cp, and...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19 and 6.9.13-44, the -sample operation performs an out-of-bounds read when a specific offset is set via the sample:offset parameter, which may result in an out-of-bounds read...