Astra Linux – vulnerability in python-django

In Django 3.2 prior to 3.2.19, 4.x prior to 4.1.9, and 4.2 prior to 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock Using f2fstrylockop in f2fswritecompressedpages to avoid potential deadlock, just as we did in f2fswritesingledatapage...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in the Linux kernel before version 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, resulting in an out-of-bounds read in the ntfssetea function in fs/ntfs3/xattr.c...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 114199369...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK versions 2020.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to the disclosure of arbitrary memory. An attacker could exploit this vulnerability to bypass security measures such as ASLR. Exploiting this issue requires user interaction, as the...

Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a stack-based buffer overflow vulnerability that could potentially lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction; a victim must open a specially crafted file...

Astra Linux – vulnerability in curl

This flaw allows an attacker to insert cookies at will into a running program using libcurl, provided that a specific set of conditions is met. Libcurl performs transfers. Within its API, an application creates “easy handles” which serve as individual handles for individual transfers. Libcurl...

Astra Linux – Vulnerability in qtbase-opensource-src

A issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. There is an incorrect HPack integer overflow check in network/access/http2/hpacktable.cpp...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/jfs: Added validation for dbmaxag and dbagpref. Both dbmaxag and dbagpref are used as indexes for the dbagfree array. However, there is currently no validation for these values, which can lead to errors. The following is a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: compress: fixed to avoid a use-after-free condition on dic. Call trace: memcpy+0x128/0x250 f2fsreadmultipages+0x940/0xf7c f2fsmpagereadpages+0x5a8/0x624 f2fsreadahead+0x5c/0x110 pagecacheraunbounded+0x1b8/0x590...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfsrelocatesyschunks The unhandled case in btrfsrelocatesyschunks loop is a corruption, as it could be caused only by two impossible conditions: - first, the search key is set up to look...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed a crash that occurred during racing fsync and size-extending writes to prealloc. We have observed crashes occurring due to duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new...

Astra Linux – vulnerability in vim

Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin could allow overwriting of arbitrary files when opening specially crafted zip archives. The impact is low, as this exploit requires direct user interaction. However, successf...

Astra Linux – Vulnerability in Rails

Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicedeleteprefixed passed blob keys directly to Dir.glob, without escaping the glob metacharacters. If a blob key contains attacker-controlled...

Astra Linux – vulnerability in ntfs-3g

A file handle created in fuselibopendir and subsequently used in fuselibreaddir allows arbitrary read and write operations to memory in NTFS-3G up to and including version 2021.8.22 when libfuse-lite is in use...

Astra Linux – Vulnerability in requests

The Requests library is an HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function used a predictable filename when extracting files from zip archives into the system’s temporary directory. If the target file already existed, it was reused without validation....

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected an OCFS2 hang caused by a recursive semaphore on a FSIOCFIEMAP within the extent list of a specially crafted mmap file. contextswitch kernel/sched/core.c:5357...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: A use-after-free issue was fixed in the asynchronous open function. Yang Erkun reported that when two threads open files at the same time and are forced to abort before a response is received, the call to nfsreleaseseqid...

Astra Linux – Vulnerability in libgsf

There is an integer overflow vulnerability in the Compound Document Binary File format parser of v1.14.52 in the GNOME Project’s G Structured File Library libgsf. A specially crafted file can lead to an integer overflow, allowing for a heap-based buffer overflow when processing the sector...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2 fixes issues related to nfs42sscopen A destination server performing a COPY operation should not accept the passed filehandle unless it is a valid filehandle. If allocfilepseudo fails, we must decrement a reference on the...