Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. Versions 8.2.1 and earlier allow an authenticated user to use a specially crafted Lua script to manipulate various LUA objects and potentially execute their own code in the context of another user. This vulnerability exists i...

Astra Linux – Vulnerability in open-vm-tools

open-vm-tools contains a file descriptor hijacking vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor, allowing them to simulate user inputs...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A array indexing vulnerability was discovered in the netfilter subsystem of the Linux kernel. The absence of a certain macro could lead to an incorrect calculation of the offset of the h-nets array, giving attackers the ability to arbitrarily increment/decrement a memory buffer beyond its bounds...

Astra Linux – Vulnerability in haveged

In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged. However, while it detects that the connecting user is not root cred.uid != 0 and prepares a negative acknowledgment ASCIINAK, it fails to stop execution. The code proceed...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in the WebUI of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in util-linux

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability was identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: rose: Fix for timer race conditions against user threads. The Rose timers only acquire the socket spinlock, without checking whether the socket is owned by a specific user thread. Add a check and reinitialize the timers i...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s vfsworm module. This module is designed to provide Write-Once, Read-Many WORM protections by preventing files from being modified after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: Fixed a possible warning in privcmdioctlmmapresource. Since ‘kdata.num’ is a user-controlled data, if the user attempts to allocate memory larger than MAXORDER, then kcalloc will fail. This will also generate a stack...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly attempt to free a pointer that was not previously allocated using kmalloc. At the same time, allocated memory is also leaked. This bug can be triggered by an unprivileged local user, and it can result in corruption of slab...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sparc: Fixed inaccurate exception reporting in copyfromtouser for UltraSPARC III. Anthony Yznaga discovered that a bug in the ext4 code, where large amounts of data were allowed, resulted from copyfromuser returning impossibly...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Netwerk: Ethernet: mvpp2main: A possible OOB write issue has been fixed in mvpp2ethtoolgetrxnfc. The rules parameter is allocated in ethtoolgetrxnfc, and its size is determined by rulecnt from the user space. Therefore, rulecnt...

Astra Linux – Vulnerability in usbguard

A issue was discovered in USBGuard prior to version 1.1.0. On systems where the usbguard-dbus daemon is running, a non-privileged user could enable USBGuard to allow all USB devices to be connected in the future...

Astra Linux – Vulnerability in Chromium

Before version 97.0.4692.99, using Omnibox in Google Chrome allowed attackers to potentially exploit heap corruption by using a crafted HTML page, as long as those attackers could convince users to engage in certain user interactions...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Property blob allocations to memcg The DRMIOCTLMODECREATEPROPBLOB function allows userspace to allocate property blobs of arbitrary size, which are backed by kernel memory. Currently, the blob data allocation is not accounte...