Astra Linux – vulnerability in linux, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Check for read-only mounted filesystem in txBegin This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk SyZBot reports that the SIFMT bits in inode-imode may become invalid when the 32-bit “mode” field loaded from disk is corrupted, or when the 32-bit “attributes” field loaded from...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected an OCFS2 hang caused by a recursive semaphore on a FSIOCFIEMAP within the extent list of a specially crafted mmap file. contextswitch kernel/sched/core.c:5357...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: a fix was made to avoid a Use-After-Free issue in f2fswriteendio. According to syzbot, a use-after-free issue occurred in f2fswriteendio. This issue is caused by the following race condition: Loop device Unmount Worker...

Astra Linux – vulnerability in lxml

Lxml is a library for processing XML and HTML in Python. Prior to version 6.1.0, using either of the two parsers with the default configuration with resolveentities=True allowed untrusted XML input to read local files. Setting the resolveentities option explicitly to resolveentities='internal' or...

Astra Linux – Vulnerability in Vim

Vim is an open-source command-line text editor. From version 9.2.0320 to 9.2.0679, a crafted undo or swap file could store a virtual-text property whose offset and length points outside the line’s property data. When Vim restores or displays such a line, it converts the offset into a pointer and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting the ACL. A NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL later. It finds that the ACL is only a default ACL based on the mode bits, not the...

Astra Linux – vulnerability in Rails

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1, and 8.1.3.1, Active Storage fails to disable libvips operations marked as unsafe for untrusted content, thereby allowing a specially crafted upload to trigger such operations. Applicatio...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in the Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file...

Astra Linux – Vulnerability in Firefox

When downloading an HTML file, if the title of the page is formatted as a filename with a malicious extension, Firefox may save the file with that extension. This could lead to potential system compromise if the downloaded file is later executed. This vulnerability affects Firefox versions earlie...

Astra Linux – Vulnerability in ntfs-3g

A buffer overflow was discovered in NTFS-3G before October 3, 2022. Metadata created within an NTFS image can lead to code execution. A local attacker can exploit this vulnerability if the ntfs-3g binary has the setuid root privilege. An attacker who is physically nearby can also exploit this...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 8.2, the scp client incorrectly sends duplicate responses to the server when a utimes system call fails. This allows a malicious, unprivileged user on the remote server to overwrite arbitrary files in the client’s download directory by creating a crafted subdirectory anywhere on the...

Astra Linux – Vulnerability in pillow

In version 9.0.1, Pillow allows attackers to delete files because spaces in temporary pathnames are mishandled...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s MagickCore/segment.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, specifically a division by zero in mathematics. This likely results in a disruption to the application’s functionality, but it may al...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the putepel16fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – vulnerability in libxpm

A flaw was found in libXpm. This issue occurs when parsing a file with a comment that is not closed; the end-of-file condition will not be detected, causing an infinite loop and resulting in a Denial of Service for the application relying on the library...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the ffhevcputhevcepelpixels8sse function in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a crafted video file...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the use of putqpelfallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix NULL pointer dereference when pin PROG, MAP, LINK without FILE When using bpftool to pin PROG, MAP, LINK without FILE, a segmentation fault occurs. The reason is that the absence of FILE causes strlen to trigger a NU...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: fixed an error in ip6routenetexitlate During the initialization of ip6routenetinitlate, if the files ipv6route or rt6stats fail to be created, the initialization is successful by default. Therefore, the ipv6route or rt6stat...