Astra Linux – Vulnerability in libstb

STBVorbis is a single-file library licensed under MIT that processes OGG Vorbis files. A properly crafted file may trigger an out-of-buffer write in the startdecoder function, because the maximum number of m-submaps is 16, but submapfloor and submapresidue are declared as arrays of 15 elements...

Astra Linux – Vulnerability in llvm-toolchain-15

It was discovered that the commit a0138390 from the llvm-project contains a segmentation fault due to the component mlir::spirv::TargetEnv::TargetEnvmlir::spirv::TargetEnvAttr...

Astra Linux – Vulnerability in Firefox, Thunderbird

By manipulating the text within the tag, an attacker could cause corrupted memory, leading to a potentially exploitable crash. This vulnerability affects Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc Generally, the qlen of any classful qdisc should reflect the number of packets held by the qdisc itself and all its children. In the case of netem, qlen only accounts...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ovl: Filtering invalid inodes with a missing lookup function. A check has been added to the ovldentryweird function to prevent the processing of directory inodes that lack the lookup function. This is important because such inode...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: pcm: Added a sanity NULL check for the default mmap fault handler. A driver may allow access to mmap before properly initializing runtime-dmaarea. A proper NULL check should be added before passing the value to virttopag...

Astra Linux – Vulnerability in ffmpeg

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library, which allows for an integer overflow, potentially leading to a denial-of-service DoS attack...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211: Set correct chandef when starting CAC When starting CAC in a mode other than AP mode, it returns a warning message: “WARNING: CPU: 0 PID: 63 at cfg80211chandefdfsusable+0x20/0xaf cfg80211” This issue is caused by...

Astra Linux – Vulnerability in Apache2

In Apache HTTP Server 2.4.59 and earlier, a null pointer dereference vulnerability in modproxy allows an attacker to crash the server through a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialize extack before use. This fix addresses the issue of missing initialization of extack in flow offload...

Astra Linux – Vulnerability in WebKit2GTK

There was an issue involving “iframe” elements across origins. This issue has been resolved through improved tracking of security origins. This issue is fixed in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. A malicious website may be able to exfiltrate data...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: A potential NULL pointer dereferencing has been fixed in ocfs2setbufferuptodate. During cleanup, if flags do not include OCFS2BHREADAHEAD, it may trigger a NULL pointer dereferencing in the ocfs2setbufferuptodate function,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the race condition issue caused by session lookup and expiration. The reference count of the session was incremented within the lock during the lookup operation, thereby avoiding the race condition related to session...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Check null-initialized variables WHAT & HOW drrtiming and subvppipe are initialized to null, and they are not always assigned new values. It is necessary to check for null before dereferencing these variables...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus – Do not free ring buffers that cannot be re-encrypted. In CoCo VMs, it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail, resulting in an error and the return of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fixed the issue of null pointer dereferencing in psbintellvdsgetmodes. In psbintellvdsgetmodes, the return value from drmmodeduplicate is assigned to mode. This could lead to a NULL pointer dereferencing in case of a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Check BIOS images before they are used. BIOS images may fail to load, and null checks are added before they are used. This fix addresses 6 NULLRETURNS issues reported by Coverity...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fixed an issue where dereferencing a null pointer could occur when retrieving the product name. This issue was discovered on the EXCELSIOR DL37-D05 device with the Loongson-LS3A6000-7A2000-DL37 motherboard. Kernel log...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Do not pass a stopped vif to the driver in .gettxpower. Avoid potentially crashing the driver due to uninitialized private data...