Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Remove a drr class from the active list if it changes to strict. Whenever a user issues a ets qdisc change command, transforming a drr class into a strict one, the ets code does not check whether that class was in...

Astra Linux – Vulnerability in grub2

A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory use-after-free issue, occurs because the normalexit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: block: Use RCU in blkmqunquiescetagset instead of set-taglistlock. The blkmqadd,delqueuetagset functions add and remove queues from the tagset. These functions ensure that the tagset and queues are marked as shared when two or...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: core: There is a race condition where the error handler is only awakened when the last running command completes or times out. This race condition can cause the SCSI layer to fail to awaken the error handler, resulting i...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and earlier, in a network-exposed cupsd with a shared target queue, an unauthorized client could send a Print-Job to that shared PostScript queue without authentication. The...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing the user-space buffer during stats queries The ethtool -S command operates through three ioctl calls: - ETHTOOLGSSETINFO for the size of the statistics data; - ETHTOOLGSTRINGS for the names of the...

Astra Linux – Vulnerability in exiv2

Exiv2 is a C++ library and a command-line utility for reading, writing, deleting, and modifying image metadata in formats such as Exif, IPTC, XMP, and ICC. Prior to version 0.28.8, a buffer overflow vulnerability was discovered in Exiv2. The vulnerability lies in the preview component, which only...

Astra Linux – Vulnerability in freeipa

A flaw was identified in the FreeIPA API audit; it sends the entire FreeIPA command line to journalctl. As a result, during the FreeIPA installation process, administrative user credentials—including the administrator’s password—are inadvertently leaked into the journal database. In the worst-cas...

Astra Linux – Vulnerability in exiv2

Exiv2 is a C++ library and a command-line utility for reading, writing, deleting, and modifying Exif, IPTC, XMP, and ICC image metadata. An out-of-bounds read vulnerability was discovered in Exiv2 versions 0.28.5 and earlier. This vulnerability occurs when Exiv2 is used to write metadata into a...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the Flatpak portal allowed paths in the sandbox-expose options, which could be app-controlled symbolic links pointing to arbitrary paths. Flatpak’s “flatpak run” command mounted the resolved host path i...

Astra Linux – Vulnerability in Python 3.11

The webbrowser.open API accepts URLs with leading hyphens, which can be treated as command-line options for certain web browsers. However, the new behavior disallows the use of leading hyphens. It is recommended that users sanitize URLs before passing them to webbrowser.open...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP – Fixed issue where multiple L2CAPECREDCONNREQUESTs were accepted. Currently, the code attempts to accept requests regardless of the command identifier. This can result in multiple requests being marked as pendin...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: MGMT: Fixed possible UAFs This attempt to fix possible UAFs is due to the fact that the struct mgmtpending is freed while it is still being processed, as seen in the following trace. To address this issue,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Remove the reference to the translation cache only for the erased entry. The vgicitsinvalidatecache function iterates through the per-ITS translation cache using xaforeach, and removes the cache reference fo...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Firmware: stratix10-svc – Fixed a bug in saving controller data. Fixed the incorrect use of platformsetdrvdata and devsetdrvdata. Both functions refer to the same data, and they override each other. This caused the svc driver’...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: avoid Non-NCQ command starvation When a non-NCQ command is issued while NCQ commands are being executed, atascsiqcissue indicates to the SCSI layer that the command issuance should be deferred by returning...

Astra Linux – Vulnerability in grub2

A vulnerability has been identified in the GRUB2 bootloader’s normal command, posing an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused by the fact that the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this...

Astra Linux – Vulnerability in Python 3.11

The imaplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: uacce: Ensure safe queue release with state management. Directly calling putqueue carries risks, as it cannot guarantee that the resources of uaccequeue have been fully released beforehand. Therefore, adding a stopqueue...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio – Add spinlock protection with virtqueue notification When a virtual machine boots with a virtio-crypto PCI device and a built-in backend, run the openssl benchmark command with multiple processes. For example:...