8385 matches found
Astra Linux - Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot reported a warning in flushwork. This warning is caused by work-func == NULL, which indicates that work initialization is missing. This can occur because...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: blktrace: Fixed a UAF in the blkTraceAccess function after removal by sysfs. There is a use-after-free issue triggered by the following process: bash P1sda P2sdb echo 0 /sys/block/sdb/trace/enable blkTraceRemoveQueue...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: mac80211: The limit on vht mcs/nss in ieee80211parsetxradiotap has been adjusted. The maximum values of vht mcs and nss in ieee80211parsetxradiotap routine have been limited to fix the following warning reported by syzbot:...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: isdn: mISDN: Fixed the sleeping function called from an invalid context. The driver can call the card-isac.release function from an atomic context. This issue was fixed by calling this function after releasing the lock. The...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: tipc: Check for a null pointer after calling kmemdup kmemdup may return a null pointer; therefore, it is necessary to check for this condition. Otherwise, the null pointer will be dereferenced later in tipccryptokeyxmit, as can b...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ipv4: Fixed a data race related to the sysctlfibsyncmem function. When reading sysctlfibsyncmem, it can be changed concurrently. Therefore, we need to add READONCE to avoid the data race...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Drivers: USB: Host: Fixed a deadlock in oxubussuspend There is a deadlock in oxubussuspend, as shown below: Thread 1 | Thread 2 | timeraction oxubussuspend | modtimer spinlockirq //1 | Wait for a while ... | oxuwatchdog...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Device property: Fixed the node refcount leak in fwnodegraphgetnextendpoint. The “parent” returned by fwnodegraphgetportparent has its refcount incremented when ‘prev’ is not NULL. This variable needs to be set after using it...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: netlink: added nla be16/32 types to the minlen array BUGs: KMSAN: uninit-value in nlavalidaterangeunsigned, lib/nlattr.c:222 inline BUGs: KMSAN: uninit-value in nlavalidateintrange, lib/nlattr.c:336 inline BUGs: KMSAN:...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Firmware is released in the brmfipciesetup error path. This prevents memory leaks if the brmfichipgetraminfo function fails. Note that the CLM blob is released in the device removal path...
Astra Linux – Vulnerability in Chromium
The use of after free in Passwords in Google Chrome before version 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in jupyter-core
Jupyter Core is a package for the core common functionalities of Jupyter projects. Prior to version 4.11.2, Jupyter Core contained an arbitrary code execution vulnerability in “jupytercore,” which stemmed from “jupytercore” executing untrusted files in the CWD environment. This vulnerability...
Astra Linux – Vulnerability in Firefox and Thunderbird
Inconsistent data in the instruction and data cache when creating Wasm code can lead to a potentially exploitable crash.This bug only affects Firefox on ARM64 platforms.. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
Astra Linux – Vulnerability in Firefox, Thunderbird
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized, resulting in a bypass that allowed device permissions to be leaked into untrusted sub-documents. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
Astra Linux – Vulnerability in Squid
A issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, sensitive information about clients using the proxy may be exposed through an HTTPS request to an internal cache manager URL. This issue has been fixed in version 5.7...
Astra Linux – Vulnerability in Firefox and Thunderbird
When resolving a symbolic link such as file:///proc/self/fd/1, an error message may be generated if the symbolic link resolves to a string containing uninitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...
Astra Linux – Vulnerability in Firefox and Thunderbird
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor might be drawn over the browser UI, potentially causing confusion for users or leading to spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...
Astra Linux – Vulnerability in Apache2
If the Apache HTTP Server 2.4.53 is configured to perform transformations using modsed, especially in contexts where the input to modsed can be very large, modsed may cause excessive memory allocation and trigger an abort...
Astra Linux – Vulnerability in libpgjava
pgjdbc is an open-source PostgreSQL JDBC Driver. In affected versions, a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream exceeds 2 kilobytes in size. This temporary file can be...