Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel up to version 5.19.9, drivers/scsi/stex.c allows local users to retrieve sensitive information from kernel memory because stexqueuecommandlck lacks a memset for the PASSTHRUCMD case...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.3.10. The file fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, resulting in a out-of-bounds read...

Astra Linux – vulnerability in rabbitmq-server

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, adding a new user via the management UI could result in the user’s name being displayed in a confirmation message due to improper sanitization of tags. This might allow JavaScript code execution within the...

Astra Linux – vulnerability in openssh

In OpenSSH versions prior to 9.6, OS command injection may occur if a username or hostname contains shell metacharacters, and such names are referenced via expansion tokens in certain scenarios. For instance, an untrusted Git repository might contain a submodule with shell metacharacters in its...

Astra Linux – vulnerability in Node.js

A OS command injection vulnerability exists in Node.js versions 14.21.1, 16.18.1, 18.12.1, and 19.0.1. This vulnerability stems from insufficient checks on allowed hosts; it can be easily bypassed since IsIPAddress fails to properly validate whether an IP address is invalid prior to making DBS...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer RevelioFuzzing reported that a SCSIIOCTLSENDCOMMAND ioctl with outlen set to 0xd42, SCSI command set to ATA16 PASS-THROUGH, ATA command set to ATANOP, and...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the type of the second parameter in the odneditdpmtable callback. With Clang’s kernel control flow integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. No users are affected as long as they follow...

Astra Linux – vulnerability in python3.7, python2.7

In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters to commands found in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input if they lack validation of user-provided filenam...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix the issue of CMDQ memory leaks When hinicsetcmdqdepth fails in hinicinitcmdqs, the cmdq memory is not released correctly. Fix it...

Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – vulnerability in exim4

Exim 4 prior to version 4.94.2 suffers from improper neutralization of line delimiters; this issue is relevant in non-default configurations that enable Delivery Status Notification DSN. Certain usage patterns involving ORCPT= can insert a newline into a spool header file, thereby indirectly...

Astra Linux – Vulnerability in binutils

A memory consumption issue in the getdata function in binutils/nm.c in GNU nm before version 2.34 allows attackers to cause a denial of service through crafted commands...

Astra Linux - vulnerability in less

Less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as files extracted from an untrusted archive. Exploitation also requires the...

Astra Linux – Vulnerability in libimage-exiftool-perl

In ExifTool’s lib/Image/ExifTool.pm, version 12.38 incorrectly handles the $file = /|$/ check, resulting in command injection...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.54 contains an incomplete list of denylists in the unsafegitcloneoptions function, which omits the --template option. This allows attackers to execute arbitrary commands during cloning operations. Attackers can specify --template to point to a directory containing...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.51 contains an incomplete command injection blocklist, which fails to account for Git’s feature of abbreviating long-option names. Attackers can bypass the safety measures by using abbreviated option names, such as “uploadp” instead of “uploadpack”. Git will then trea...

Astra Linux – Vulnerability in Node.js

A OS command injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check. This vulnerability can be easily exploited, as the IsIPAddress function does not properly check whether an IP address is invalid before making DBS requests, thereby...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.51 fails to protect against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote. This allows command injection through options such as --exec/--upload-pack, leading to arbitrary command execution. Additionally, Repo.itercommits and...

Astra Linux – vulnerability in linux-5.15

A flaw was found in the Linux kernel’s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2LOGOFF and SMB2CLOSE commands. The issue arises from the lack of proper locking when performing operations on an object. An attacker can exploit this...