Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifscomposemountoptions The optional @ref parameter might contain a NULL nodename; therefore, prevent dereferencing it in cifscomposemountoptions. Addresses-Coverage: 1476408 “Explicit null dereference...

Astra Linux – vulnerability in Firefox

SVG use tags referencing a same-origin document could have led to script execution if attacker input was sanitized via the HTML Sanitizer API. This would require the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox 102...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel prior to version 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/drdomain.c misinterprets the return value of mlx5getuarspage which is expected to be NULL in error cases, but actually represents an error pointer...

Astra Linux – vulnerability in fribidi

A stack-based buffer overflow flaw was found in the Fribidi package. This flaw enables an attacker to supply a specially crafted file to the Fribidi application, potentially resulting in a memory leak or a denial of service...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: The issue of dereferencing a stale list iterator after the loop body has been executed has been fixed. The list iterator variable will become a bogus pointer if no break is executed. Dereferencing it in this case, cur-page...

Astra Linux – Vulnerability in Firefox

When downloading an HTML file, if the title of the page is formatted as a filename with a malicious extension, Firefox may save the file with that extension. This could lead to potential system compromise if the downloaded file is later executed. This vulnerability affects Firefox versions earlie...

Astra Linux – Vulnerability in openexr

A flaw was discovered in OpenEXR’s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image file to have it processed by OpenEXR, resulting in a floating-point exception error. The greatest threat posed by this vulnerability is to system availabili...

Astra Linux – Vulnerability in Zabbix

During Zabbix installation from RPM, the DACOVERRIDE SELinux capability is used to access PID files in the /var/run/zabbix folder. In this case, processes of Zabbix Proxy or Server can bypass the file read, write, and execute permission checks at the file system level...

Astra Linux – Vulnerability in pillow

In version 9.0.1, Pillow allows attackers to delete files because spaces in temporary pathnames are mishandled...

Astra Linux – vulnerability in openimageio

There is an out-of-bounds read vulnerability in how OpenImageIO version v2.3.19.0 processes string fields within TIFF image files. A specially crafted TIFF file can result in information disclosure. An attacker can supply a malicious file to trigger this vulnerability...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to perform a sanity check on the inlinedots inode As Wenqing reported in bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=215765 This will result in a kernel panic under the following steps: - mkdir mnt - mount...

Astra Linux – vulnerability in linux-5.15, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object 0xffffc900002a9000 size 4096: comm "kexec", pid 14950, jiffies 4295110793 age 373.951s hex dump first 32 bytes: 7f 45 4c 4...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tracing: kprobe: Fix potential null-ptr-deref on traceeventfile in kprobeeventgentestexit When tracegeteventfile failed, genkretprobetest will be assigned as the error code. If module kprobeeventgentest is removed now, the null...

Astra Linux – vulnerability in Firefox

A compromised web child process can disable web security opening restrictions, resulting in a new child process being spawned within the file:// context. With a reliable exploit primitive, this new process can be exploited again, leading to arbitrary file reading. This vulnerability affects Firef...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick, specifically in the MagickCore/visual-effects.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, including division by zero in mathematics. The greatest threat of this vulnerability is to system...

Astra Linux – Vulnerability in hdf5

A SIGFPE signal is raised in the function H5Dcreatechunkfilemaphyper of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempt to parse a crafted HDF file. This occurs due to incorrect protection against division by zero. This could allow a remote denial-of-service attack...

Astra Linux – vulnerability in hdf5

A SIGFPE signal is raised in the function H5Dchunksetinforeal within H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempt to parse a specially crafted HDF file; this occurs due to improper protection against division by zero. This issue is distinct from CVE-2018-11207...

Astra Linux – Vulnerability in Poppler

A vulnerability was discovered in the freedesktop Poppler version 20.12.1. This vulnerability allows remote attackers to trigger a Denial-of-Service DoS attack through a crafted .pdf file, targeting the FoFiType1C::cvtGlyph function...

Astra Linux – Vulnerability in hdf5

There is an out-of-bounds write vulnerability in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially crafted GIF file can lead to code execution. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Golang-1.19

A denial of service may occur due to excessive resource consumption in the net/http and mime/multipart libraries. Parsing multipart forms using mime/multipart.Reader.ReadForm can consume a largely unlimited amount of memory and disk space. This issue also affects form parsing in the net/http...