Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, there was a heap out-of-bounds read vulnerability in the coders/dcm.c module. When processing DICOM files with a specific configuration, the decoder loop...

Astra Linux – Vulnerability in wpa

Implementations of SAE in hostapd before version 2.10, and wpasupplicant before version 2.10, are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists due to an incomplete fix for CVE-2019-9494...

Astra Linux – Vulnerability in Qemu

No description...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bug: Unchecked dereferencing of a NULL pointer in the kernel. Address: 0000000000000000 Causes: - ip6rcvcore net/ipv6/ip6input.c:190:20 - ipv6rcv net/ipv6/ip6input.c:306:8 - processbacklog net.core/dev.c:6186:4 - napipoll...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed the issue where krb5 mounts failed when the client tried to mount shares with incorrect credentials. It turned out that the client was reusing the SMB session from the first mount attempt, even though a differe...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ICE: xsk: prohibit usage of non-balanced queue ID Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z The above refers to a situation where a user wants to attach an XSK socket in txonly mode at a...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, the MAT decoder used 32-bit arithmetic due to incorrect parenthesization, resulting in a heap over-read. This vulnerability has been fixed in versions 7.1.2-16...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF A hung task trace was observed during LOGO processing. 974.309060 0000:00:00.0: qedfehdevicereset:868: 1:0:2:0: LUN RESET issued… 974.309065 0000:00:00.0:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Do not call scsiremovehost in pm8001alloc Calling scsiremovehost before scsiaddhost results in a crash. Bug: Kernel NULL pointer dereferencing; address: 0000000000000108 RIP: 0010: devicedel+0x63/0x440 Call trace: 1...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick in versions prior to 7.0.11. There is a potential for a cipher leak when calculating signatures using TransformSignature. The greatest threat of this vulnerability is related to data confidentiality...

Astra Linux – Vulnerability in glibc

The iconv feature in the GNU C Library also known as glibc or libc6, up to version 2.32, may have a buffer over-read issue when processing invalid multi-byte input sequences in the EUC-KR encoding...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed a slab-use-after-free read in mgmtremoveadvmonitorsync. This fixed the following crash: BUG: KASAN: Slab-use-after-free in mgmtremoveadvmonitorSync+0x3a/0xd0, net/bluetooth/mgmt.c:5543. A 8-byte read at...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Fixed a use-after-free issue related to dynamic ftraceops. KASAN reported a use-after-free involving ftrace ops 1. It was discovered that perf had registered two ops with the same content, both being dynamic. After the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Avoid invalid reads in irdmanetevent. The irdmanetevent function should not dereference anything from “neigh” alias “ptr” until it has checked that the event is of type NETEVENTNEIGHUPDATE. Other events are pointed to...

Astra Linux – Vulnerability in aspell

The libaspell.a file in GNU Aspell before version 0.60.8 has a buffer overflow issue for strings that end with a single '\0' byte. This issue occurs when the encoding is set to ucs-2 or ucs-4 outside of the application, as indicated by the ASPELLCONF environment variable...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Unicode: Fixed the error path in utf8load. utf8load requests the symbol “utf8datatable” and then checks whether the requested UTF-8 version is supported. If it’s not supported, it attempts to load the data table using symbolput. ...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64, including excessive whitespace. Earlier, unsupported Django versions such a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fixed the jump offset calculation in tailcall. The additional call to bpfintjitcompile skips the JIT context initialization. This effectively skips the offset calculation, resulting in outoffset = -1. Therefore, t...

Astra Linux – Vulnerability in JRuby

A vulnerability was discovered in Ruby versions 2.5.8, 2.6.x up to 2.6.6, and 2.7.x up to 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, did not rigorously check the transfer-encoding header value. An attacker could potentially exploit this vulnerability to bypass a reverse proxy which...

Astra Linux – Vulnerability in Git

Gitk is a Tcl/Tk-based Git history browser. Starting with version 1.7.0, when a user clones an untrusted repository and runs Gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option “Support per-file encoding” must have been...