Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags blkmqclearflushrqmapping is not called during scsi probe, by checking blkqueueinitdone. However, QUEUEFLAGINITDONE is cleared in delgendisk by commit aec89dc5d421 "block: keep...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: Fixed the UBSAN shift-out-of-bounds warning. Syzkaller reported a UBSAN shift-out-of-bounds warning related to 1UL order in isolatefreepagesblock. The bogus compoundorder value can be any value, as it is a union wi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: exfat: Fixed random stack corruption that occurs after getblock. When getblock is called with a bufferhead allocated on the stack, such as in dompagereadpage, stack corruption due to UAF of the bufferhead may occur in the followi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Block: Fix to add folio to bio. A size of 4GB for folio is possible on some ARCHs, such as aarch64. A size of 16GB for hugepage is also supported. However, the “offset” of folio cannot be stored in “unsigned int”, which causes a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ublk: The handling of recovery and reissue in ublkabortqueue has been fixed. The commit 8284066946e6 “ublk: grabbing the request reference when the request is handled by userspace” does not grab the request reference in case of...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A use-after-free issue was fixed in smbbreakalllevIIoplock. There is a section within smbbreakalllevIIoplock that can cause race conditions when unlocking during the loop. This patch uses a read lock to protect the entire...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: hardened the blockgroup::bglist against race conditions involving listdel. As far as I can see, calls to listdelinit on bglist cannot run concurrently with btrfs.markbgunused or btrfs.markbgtoreclaim, as these operation...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Block: Integrity – Do not call setpagedirtylock Placing multiple protection information buffers within the same page can lead to errors, as setpagedirtylock cannot be called from an interrupt context. Since a protection informati...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Block: Fixed resource leak in the blkmqsysfsregister error path. When registration of a queue fails after blkmqsysfsregister is successful, but the function later encounters an error, we need to clean up the blkmqsysfs resources...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: Fixed a use-after-free in cifsfilldirent. There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warning...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase the blocksequence array size Why It is possible to generate more than 50 steps in hwssbuildfastsequence, for example, with a 6-pipe ASIC where all pipes are part of one MPC chain. This causes the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: Avoid using multiple devices of different types. For multiple devices, both the primary and additional devices should be of the same type. erofsinitdevice already ensures that if the primary device is a file-backed device,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the blkzonewplugbiowork function, do not use submitbionoacctnocheck. Queues of zone write operations have already gone through all preparations in the submitbio path, including freeze protection. Submitting these operations...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library. This flaw can lead to an over-reading of the heap buffer, as the size of a filter block may exceed the Lempel-Ziv-Storer-Schieber LZSS window. This means that the library may attempt to read beyond the allocated memory buffer, which c...

WordPress Game Review Block plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Game Review Block versions = 4.8.1...

CVE-2025-5923 Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5923

The WordPress plugin Game Review Block (versions up to and including 4.8.1) is affected by a Stored Cross-Site Scripting (Stored XSS) vulnerability in the className parameter due to insufficient input sanitization and output escaping. Exploitation requires Contributor-level access or higher, and ...

CVE-2025-5923 Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

PT-2025-25389 · WordPress · Game Review Block

Name of the Vulnerable Software and Affected Versions: The Game Review Block plugin for WordPress versions up to, and including, 4.8.1 Description: The issue is related to Stored Cross-Site Scripting via the className parameter due to insufficient input sanitization and output escaping. This allo...

WordPress plugin Game Review Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...