Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize the completion object before requesting the interrupt request IRQ. In the report by Jaeyoung Chung: “The spearadcprobe function in drivers/iio/adc/spearadc.c registers its interrupt handler using...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usb: cdns3 – Fix for use-after-free at workaround 2 BUG: KFENCE – Use-after-free during read operation in listdelentryvalid+0x10/0xac The code snippet is as follows: c cdns3wa2removeoldrequest … kfreeprivreq-request.buf;...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Serialize lock/unlock operations in relation to other NAND operations. The functions nandlock and nandunlock involve calling chip-ops.lockarea/unlockarea, but they do not hold the NAND device lock. In controllers th...

Astra Linux – Vulnerability in ffmpeg

FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service...

Astra Linux – Vulnerability in exiv2

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit this vulnerability to cause a denial of...

Astra Linux – Vulnerability in hdf5

A SIGFPE signal is raised in the function applyilters of h5repackfilters.c in the HDF HDF5 through 1.10.3 library during an attempt to parse a crafted HDF file, due to incorrect protection against division by zero. This could allow a remote denial-of-service attack...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: chipidea – fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must also contain a call to dput; otherwise, memory will leak over time. To simplify things, simply call...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rxrpc: a reference count leak was fixed in rxrpcserverkeyring. This patch addresses the reference count leak in rxrpcserverkeyring by checking whether rx-securities has already been set...

Astra Linux – Vulnerability in Golang-1.19

The go command may execute arbitrary code during compilation when using cgo. This can occur when running “go get” on a malicious module, or when running any other command that compiles unauthorized code. This issue can be triggered by linker flags, specified via the cgo LDFLAGS directive. The...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix refcount leak on error path When failing to allocate reportdesc, opts-refcnt has already been incremented; therefore, it needs to be decremented to prevent the options structure from being permanently locke...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2, iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, and watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

A issue was discovered in lib/kobject.c in the Linux kernel before version 6.2.3. With root access, an attacker can trigger a race condition that results in an out-of-bounds write of the fillkobjpath variable...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Linux Toolkit Theming in Google Chrome on Linux prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: qdsp6: topology: check widget type before accessing data Check the widget type before accessing private data, as this could be a virtual widget that is not associated with a DSP graph, container, or module. Accessing...

Astra Linux – Vulnerability in exempi

The XMP Toolkit version 2020.1 and earlier versions is affected by a memory corruption vulnerability, which may lead to the execution of arbitrary code within the context of the current user. User interaction is required to exploit this vulnerability...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library, which allows for an integer overflow. This could potentially lead to a denial-of-service DoS attack or other undefined behaviors...

Astra Linux – Vulnerability in PHP 8.1

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, and 8.3. before 8.3.14, when using streams with a configured proxy and the “requestfulluri” option, the URI is not properly sanitized. This can lead to HTTP request smuggling, allowing attackers to use the proxy to send arbitrary HTTP reques...

Astra Linux – Vulnerability in node-browserify-sign

“browserify-sign” is a package that duplicates the functionality of Node’s crypto public key functions. Much of this functionality is based on Fedor Indutny’s work on “indutny/tls.js”. There is a issue with upper-bound checking in the “dsaVerify” function, which allows an attacker to create...

Astra Linux – Vulnerability in hdf5

A memory leak in the H5Ochunkdeserialize function within H5Ocache.c, part of the HDF HDF5 library, from version 1.10.3 allows attackers to cause a denial of service due to excessive memory consumption through an exploitable HDF5 file...