Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an Integer Overflow vulnerability that may lead to application-level denial of service for the current user. Exploitation requires user interaction; the victim must open a specially crafted file...

Astra Linux – vulnerability in docker.io-app

BuildKit is a toolkit for efficiently, expressibly, and repeatably converting source code into build artifacts. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend could generate an API message that caused files to be written outside the BuildKit state directory within th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate the file size. len is used to store the result of isizeread. Therefore, making len a sizet type results in truncation to 4GiB on 32-bit systems...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential corruption when moving a directory F2FS has the same issue in ext4rename causing crash revealed by xfstests/generic/707. See also commit 0813299c586b “ext4: Fix possible corruption when moving a directory”...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fixed an infinite loop in attrloadrunsrange when there are inconsistencies in metadata. We have identified a bug in the ntfs3 file system where a malformed NTFS image can cause an infinite loop. This occurs when an...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check whether we are out of bounds relative to the size of the tree. This can occur in scenarios where the filesystem metadata...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 8.2, the scp client incorrectly sends duplicate responses to the server when a utimes system call fails. This allows a malicious, unprivileged user on the remote server to overwrite arbitrary files in the client’s download directory by creating a crafted subdirectory anywhere on the...

Astra Linux – vulnerability in Samba

All versions of Samba prior to 4.13.16 are vulnerable to a malicious client exploiting an SMB1 or NFS race condition, allowing a directory to be created in a location within the server’s file system that is not exported under the share definition. It should be noted that SMB1 must be enabled, or...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in Cryptohome within Google Chrome prior to version 88.0.4324.96 allowed a local attacker to perform OS-level privilege escalation via a specially crafted file...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome on Windows prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...

Astra Linux – Vulnerability in sysstat

In sysstat versions up to 12.7.2, there is a multiplication integer overflow in the checkoverflow function in common.c. NOTE: This issue exists due to an incomplete fix for CVE-2022-39377...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...

Astra Linux – vulnerability in LibreOffice

Vulnerability allowing unauthorized actors to manipulate environment variables and arbitrary values in INI files within The Document Foundation LibreOffice. URLs can be crafted to expand environment variables or INI file values; thus, potentially sensitive information may be exfiltrated to a remo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free on readalloconename error The function readalloconename fails to initialize the name field of the passed fscryptstr struct if kmalloc cannot allocate the corresponding buffer. As a result, it...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: Fixed an uninitialized value in ocfs2filereaditer. Syzbot has reported the following KMSAN errors: BUG: KMSAN: Uninitialized value in ocfs2filereaditer+0x9a4/0xf80; ocfs2filereaditer+0x9a4/0xf80; ioread+0x8d4/0x20f0;...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflow in nfssysfslinkrpcclient The name field is defined as char64, while the size of clnt-clprogram-name remains unknown. Direct invocation of strcat can also result in a potential buffer overflow...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4shutdowncallback If nfs4client is in a courtesy state, there is no reason to send the callback. This causes nfsd4shutdowncallback to hang, as clcbinflight is not set to 0. This hang lasts approximately 15...

Astra Linux – Vulnerability in Git

Git GUI allows you to use Git source control management tools through a graphical interface. When a user clones an untrusted repository and is tricked into editing a file located in a directory with a malicious name in the repository, Git GUI can create and overwrite files for which the user has...

Astra Linux – vulnerability in exim4

Exim 4 prior to version 4.94.2 allows execution with unnecessary privileges. Since Exim runs as root in the spool directory which is owned by a non-root user, an attacker can write to the /var/spool/exim4/input spool header file; a specially crafted recipient address in this file can then...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in the File System API of Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...