Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/shmem-helper: Removed the erroneous “put” operation in the error path. The drmgemshmemmmap function does not handle this reference properly, resulting in the GEM object being freed prematurely, leading to a “use-after-free...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Guest View of Google Chrome before version 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Qemu

A race condition flaw was discovered in the 9pfs server implementation of QEMU, up to and including version 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The greatest threat posed by this vulnerability is to...

Astra Linux – Vulnerability in liblivemedia

Live555 version 1.08 does not handle MPEG-1 or 2 files properly. Sending two consecutive RTSP SETUP commands for the same track causes a use-after-free error and results in a crash of the daemon...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: zram: Fixed the potential UAF Use-after-Free in the zram table. If zrammetaalloc fails early, it frees the allocated zram-table without setting it to NULL. This could potentially allow zrammetafree to access the table if the...

Astra Linux – Vulnerability in libxml2

In versions of libxml2 before 2.12.10 and 2.13.x before 2.13.6, there is a use-after-free issue in the xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables functions in the xmlschemas.c file. To exploit this vulnerability, a crafted XML document must be validated against an XML schema with...

Astra Linux – Vulnerability in Chromium

Before version 94.0.4606.54, using the "after free" mechanism in the File System API in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A use-after-free vulnerability exists in the Linux kernel’s net/sched: schqfq component, which can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers a use-after-free in qfqdequeue, due to the incorrect .pe...

Astra Linux – Vulnerability in busybox

A use-after-free in Busybox 1.35-x’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the copyvar function...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: A use-after-free occurred in the powersupplychanged function. By using the devm variant to request the IRQ before using the devm variant to allocate/register the powersupply handle, the powersupply handle...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: The use-of-memory issue in driveroverrideshow has been fixed. The driveroverrideshow function reads the driveroverride string without holding the devicelock. However, driveroverridestore uses driversetoverride, which...

Astra Linux – Vulnerability in Chromium

Using use after free in ServiceWorker in Google Chrome before version 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.96, using "Use after free" in DevTools in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, using free after in XML in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of After Free in Media in Google Chrome before version 148.0.7778.168 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox, Thunderbird

The concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a “use-after-free” condition, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: Ethernet:enic: A use-after-free bug has been fixed in enichardstartxmit. In enichardstartxmit, it calls enicqueuewqskb. Inside enicqueuewqskb, if an error occurs, the skb will be freed by devkfreeskbskb. However, the freed skb is...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: jffs2: A use-after-free occurred in jffs2clearxattrsubsystem. When we mount a jffs2 image, it is assumed that the first few blocks of the image are normal and contain at least one xattr-related inode. However, the next block may ...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A use-after-free vulnerability was discovered in iscsiswtcpsessioncreate in drivers/scsi/iscsitcp.c within the SCSI sub-component of the Linux kernel. This flaw allows an attacker to access internal kernel information...