Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.96, using “after free” in Google Chrome’s views allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.96, using WebCodecs in Google Chrome allowed a remote attacker to perform an out-of-bounds memory read through a crafted video file. Chromium security severity: Medium...

Astra Linux – Vulnerability in mongo-c-driver

The Cyrus SASL integration of the MongoDB C Driver performs unsafe string copying during username canonicalization, allowing a heap buffer overflow before any authentication or network traffic occurs. This can be triggered by passing untrusted input as the username in a MongoDB URI with...

Astra Linux – Vulnerability in Chromium

Script injection in the UI of Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to perform certain UI gestures to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Wireshark

An infinite loop in the BitTorrent DHT dissector in Wireshark versions 3.6.0, 3.4.0, and 3.4.10 allows for denial of service through packet injection or malicious capture files...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/apic: Disabling x2apic during resume if the kernel expects it to be disabled. When resuming from S2ram, the firmware may re-enable x2apic mode, which might have been disabled by the kernel during boot—either because it does n...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8723bs – The data in rtwgetieex was properly validated. Just like in commit 154828bf9559 “Staging: rtl8723bs: fix out-of-bounds read in rtwgetie parser”, we don’t trust the data in the frame. Therefore, we should chec...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/v3d: Set DMA segment size to avoid debug warnings When using V3D rendering with CONFIGDMAAPIDEBUG enabled, the kernel occasionally reports a segment size mismatch. This is because ‘maxsegsize’ is not set. The kernel defaul...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rapidio: Replace riofreenet with kfree in rioscanallocnet. When the idtab allocation fails, the network is not yet registered with rioaddnet. Therefore, calling kfreenet is sufficient to release the memory. Set mport-net to NULL ...

Astra Linux – Vulnerability in Firefox

We are aware that the exploit code for this vulnerability is publicly available. However, we have no knowledge of any attacks in the wild that exploit this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13...

Astra Linux - Vulnerability in linux-5.10, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Fix IRQ resource leak The interrupt handler is set up, but just a few lines later, if iiotriggerregister fails, the function returns without properly releasing the handler. Added a cleanup goto to resolve the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uether: Fixed a race condition between getherdisconnect and ethstop. A race condition between getherdisconnect and ethstop can lead to a NULL pointer dereferencing. Specifically, if ethstop is triggered concurrently...

Astra Linux – Vulnerability in Wireshark

The Dissection engine LZ77 decompression function in Wireshark versions 4.6.0 to 4.6.4, and 4.4.0 to 4.4.14 experiences denial-of-service attacks...

Astra Linux – Vulnerability in Wireshark

The GNW protocol dissector’s infinite loop in Wireshark versions 4.6.0 to 4.6.4, and 4.4.0 to 4.4.14 allows for denial of service attacks...

Astra Linux – Vulnerability in Wireshark

The GSM RP protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows for denial of service attacks...

Astra Linux – Vulnerability in Wireshark

The OpenFlow v6 protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows for denial of service attacks...

Astra Linux – Vulnerability in Wireshark

The DCP-ETSI protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows for denial of service attacks...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: The array skb2-cb was cleared in ip4ip6err. Oskar Kjos reported the following issue: ip4ip6err calls icmpsend on a cloned skb, where the cb was written by the IPv6 receive path as struct inet6skbparm. icmpsend passes...