Astra Linux – Vulnerability in php-pear

In ArchiveTar version 1.4.11, the Tar.php script allows write operations involving directory traversal, due to insufficient checking of symbolic links. This issue is related to CVE-2020-28948...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoided possible crashes when edev-pdev changes. If a PCI device is removed during eehpereportedev, edev-pdev will change, which may cause a crash. It is recommended to hold the PCI rescan/remove lock while taking a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fixed the issue where the workqueue was not released upon calling .release. The workqueue associated with a DSA/IAA device is not released when the object is freed...

Astra Linux – Vulnerability in JQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources—even after sanitizing it—to one of jQuery’s DOM manipulation methods e.g., .html, .append, etc. may execute untrusted code. This issue has been fixed in jQuery 3.5.0...

Astra Linux – Vulnerability in Firefox

An attacker was able to perform out-of-bounds read or write operations on a JavaScript object by exploiting a bug related to range-based bounds checks. This vulnerability affects Firefox versions prior to 124.0.1...

Astra Linux – Vulnerability in JQuery

In jQuery, starting from version 1.12.0 and before 3.5.0, passing HTML from untrusted sources—even after sanitizing it—to one of jQuery’s DOM manipulation methods e.g., .html, .append, etc. may execute untrusted code. This issue has been fixed in jQuery 3.5.0...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hfsplus: fixed a slab-out-of-bounds issue in hfsplusbnoderead The hfsplusbnoderead method can trigger this issue: 174.852007 T9784 ================================================================== 174.852709 T9784 BUG: KASAN:...

Astra Linux – Vulnerability in libmysofa

A buffer overflow in the readDataVar function in hdf/dataobject.c within Symonics’ libmysofa 0.5 – 1.1 allows attackers to execute arbitrary code through a crafted SOFA...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: removed the unused checkbuddypriv function. The commit 2461c7d60f9f “rtlwifi: Update header file” introduced a global list of private data structures. Later, the commit 26634c4b1868 “rtlwifi: Modify existing bits t...

Astra Linux – Vulnerability in libjackson-json-java

A flaw was discovered in the org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities, similar to CVE-2016-3720, also affect the codehaus jackson-mapper-asl libraries, but in different classes...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hfs: fixed the missing hfsbnodeget function in hfsbnodecreate. Syzbot discovered a kernel bug in hfsbnodeput: Kernel bug at fs/hfs/bnode.c:466! Invalid opcode: 0000 1 PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: Fixed a potential integer overflow in the checkcommandsizeinblocks function. The checkcommandsizeinblocks function calculates the data size in bytes by shifting common-datasizefromcmnd by the block size...

Astra Linux – Vulnerability in Chromium

The use of uninitialized resources in the GPU in Google Chrome prior to version 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in ffmpeg

An integer overflow vulnerability exists in the function filterprewitt in libavfilter/vfconvolution.c in Ffmpeg 4.2.1. Attackers can exploit this vulnerability to cause a Denial of Service or other unspecified impacts...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...

Astra Linux – Vulnerability in ICU

It was discovered that International Components for Unicode ICU-20850 v66.1 contains a use after free bug in the pkgcreateWithAssemblyCode function in the tools/pkgdata/pkgdata.cpp file...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fixed error handling in enainit The enainit function no longer destroys the workqueue created by createsinglethreadworkqueue when pciregisterdriver fails. Calling destroyworkqueue when pciregisterdriver fails prevents...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/nouveau/kms/nv50-: fixed the file release memory leak. When using singleopen to open a device, singlerelease should be called. Otherwise, the “op” that was allocated in singleopen will be leaked...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211tdlsoper When NL80211TDLSENABLELINK is called, the code only checks whether the station exists, but does not check whether it is actually a TDLS station. This allows the operation to...