Astra Linux – vulnerability in binutils

An issue was discovered in the mergestrings function within merge.c in the Binary File Descriptor BFD library also known as libbfd, as included in GNU Binutils 2.31. There is a NULL pointer dereference in bfdaddmergesection when attempting to merge sections with large alignments. A specially...

Astra Linux – Vulnerability in GIMP

GIMP PSD File Parsing: Heap-Based Buffer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a UAF in cifsdemultiplexthread There is a UAF when performing xfstests on cifs: BUG: KASAN: Use-after-free in smb2isnetworknamedeleted+0x27/0x160 Reading a size 4 value at address ffff88810103fc08 by task cifsd/923...

Astra Linux – Vulnerability in Tomcat9

Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...

Astra Linux – vulnerability in dcmtk

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2setbufferuptodate During cleanup, if flags without OCFS2BHREADAHEAD are present, it may trigger a NULL pointer dereference in ocfs2setbufferuptodate when bh is NULL...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42completecopies On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location on the same NFS server. Accidentally,...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmtbudmin is less than zero, it causes errors in later stages. A check has been added to return an error beforehand in dbAllocCtl itself...

Astra Linux – vulnerability in libfile-find-rule-perl

File::Find::Rule up to version 0.34 for Perl is vulnerable to arbitrary code execution when grep encounters a specially crafted filename. A file handle is opened using the 2-argument form of open, allowing an attacker-controlled filename to supply the MODE parameter to open, thereby turning the...

Astra Linux – vulnerability in grub2

GNU GRUB also known as GRUB2 up to version 2.12 contains a heap-based buffer overflow in fs/hfs.c caused by specially crafted sblock data within an HFS filesystem...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit the printed string from the FW file. There is no guarantee that the file always has a NUL-termination; therefore, reading the string may go beyond the end of the TLV. If that is the last TLV in the file, it...

Astra Linux – vulnerability in dcmtk

A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service DoS via a crafted DICOM file...

Astra Linux - уязвимость в linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix missing iop in ntfsreadmft There is null pointer dereference because iop == NULL. The bug happens because we don't initialize iop for records in $Extend...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files When a write to an inline file fails or occurs only partially, we still update the length of inline data as if the entire write succeeded. Fix the update of inline...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fix null pointer dereference in tracingerrlogopen Fix an issue in the ‘tracingerrlogopen’ function. The function does not call ‘seqopen’ when the file is opened only with write permissions, which results in...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Fix null-ptr-deref Read in txBegin Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the...

Astra Linux – vulnerability in catdoc

A memory corruption vulnerability exists in the Shared String Table Record Parser implementation within xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Allow ext4getgroupinfo to fail. Previously, ext4getgroupinfo would treat an invalid group number as a BUG, since this should theoretically never happen. However, if a malicious attacker modifies the superblock via the block...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents When merging very long extents, we attempt to push as much length as possible to the first extent. However, this is unnecessarily complicated and not really worth the trouble...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfsscinfo in nilfssegctorthread The finalization of nilfssegctorthread can race with nilfssegctorkillthread, which terminates that thread; this may result in a use-after-free BUG as detected ...