Astra Linux – Vulnerability in Chromium

In V8, the "out of bounds" reading in Google Chrome before version 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption through a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

A vulnerability related to out-of-bounds reads has been addressed through improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, and iPadOS 15.2, as well as watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code executio...

Astra Linux – Vulnerability in DjVuLibre

A flaw was discovered in djvulibre-3.5.28 and earlier. A malicious read operation in the function DJVU::DataPool::hasdata, through a crafted djvu file, may cause the application to crash and lead to other issues...

Astra Linux – Vulnerability in busybox

An out-of-bounds heap read in Busybox’s unlzma applet leads to information leakage and denial of service when LZMA-compressed input is decompressed. This can be triggered by any applet/format that…...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: JAXP. The supported versions affected include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not blindly read the IP address in ftracebug. It was reported that a bug in arm64 caused a bad IP address to be used for updating a NOP instruction in ftraceinit. However, the error path correctly returned -EINVAL...

Astra Linux – Vulnerability in DjVuLibre

DjVuLibre 3.5.27 allows attackers to carry out a denial-of-service attack application crashes due to an out-of-bounds read by creating a corrupted JB2 image file. This occurs due to improper handling of the JB2 image file in the JB2Dict::JB2Codec::getdirectcontext function in libdjvu/JB2Image.h,...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. The vulnerability is difficult to exploit; an unauthenticated...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: Bound iinlinexattrsize for inodes without inlinexattr When the flexibleInlinexattr feature is enabled, doread inode the iinlinexattrsize value from disk: c if f2fssbhasflexibleInlinexattrsbi fi-iinlinexattrsize =...

Astra Linux – Vulnerability in Zabbix

The researcher is demonstrating that it is possible to leak a small amount of Zabbix Server memory through an out-of-bounds read in the src/libs/zbxmedia/email.c file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: Fixed a data race on lastboostedvcpu in kvmvcpuonspin. Used READ,WRITEONCE to access kvm-lastboostedvcpu to ensure that reads and writes are atomic. In the extremely unlikely scenario where the compiler introduces errors in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ima: Avoid blocking in the RCU read-side critical section. A panic occurs in imamatchpolicy: BUG: Unable to handle a NULL pointer dereferencing in the kernel at 0000000000000010. PGD 42f873067 P4D 0 Oops: 0000 1 SMP NOPTI CPU:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netpoll: A race condition has been fixed in netpollowneractive. KCSAN detected a race condition in netpoll: - BUG: KCSAN: Data race in netrxaction/netpollsendskb. A write operation marked as 0xffff8881164168b0, 4 bytes is perform...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Fixed a potential race condition in fib6 Droppcpufrom. syzbot detected a race condition in fib6 Droppcpufrom 1. If the compiler reads the value more than once ppcpurt, the second reading might result in NULL, especially ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set the object to close if ondemandid 0 in copen. If copen is called maliciously in user mode, it may delete the request corresponding to the random ID. Moreover, the request may not have been read yet...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: cougar – fixed a slab-out-of-bounds read in cougarreportfixup. The reportfixup function for the Cougar 500k Gaming Keyboard did not verify that the report descriptor size was correct before accessing it...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: The possibility of a Use-after-Free condition arises when selecting an endpoint. The functions selectlocaladdress and selectsignaladdress both select an endpoint from a list within the RCU-protected section. However,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: fixed a possible Use-after-Allocation UAF in ip6finishoutput2. If skbexpandhead returns NULL, the skb is freed, and the associated dst/idev may also be freed. We need to hold the rcureadlock to ensure that the dst and...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevented possible UAF in ip6xmit If skbexpandhead returns NULL, the skb has been freed, and the associated dst/idev may also have been freed. We must use rcureadlock to prevent possible UAF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/client: Avoid referencing rdata=NULL in smb2newreadreq. This occurs when calling from SMB2read while using rdma, and when reaching the rdmareadwritethreshold...