Astra Linux – vulnerability in Samba

A flaw was found in how Samba handles file and directory permissions. An authenticated user could exploit this flaw to gain access to certain file and directory information that would otherwise be inaccessible to attackers...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs: Check overflow when iterating ATTRRECORDs The kernel iterates over ATTRRECORDS in mft records in ntfsattrfind. Since ATTRRECORDS are adjacent to each other, the kernel can access the next ATTRRECORD from the end address of...

Astra Linux – vulnerability in poppler

An issue was found in Poppler 0.71.0. There is a reachable abort in Object.h; this will result in a denial of service since EmbFile::save2 in FileSpec.cc fails to perform a stream check prior to saving an embedded file...

Astra Linux – Vulnerability in binutils

In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the processarchive function in readelf.c via a crafted ELF file...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: NFS: fix an incorrect limit in filelayoutdecodelayout “sizeofstruct nfsfh” is two bytes too large and could lead to memory corruption. It should be NFSMAXFHSIZE because that’s the size of the -data buffer. I reversed the size of...

Astra Linux – Vulnerability in binutils

In the GNU Binutils before version 2.40, there is a heap-buffer-overflow issue in the error function bfdgetl32 when called from the stripmain function in strip-new, through a specially crafted file...

Astra Linux – Vulnerability in libde265

Libde265 v1.0.4 contains a heap buffer overflow in the putweightedbipred16fallback function, which can be exploited through a specially crafted file...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stress-testing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found that some short-lived temporary pages were n...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inlinedata 1. Mount with wsync. 2. Create a file with ORDWR, and the request was sent to mds.0: cephatomicopen-- cephmdscdorequestopenc finishopenfile, dentry, cephopen--...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, thp: Bail out early for writeback pages in collapsefile Currently, collapsefile does not explicitly check PGwriteback. Instead, pagehasprivate and trytoreleasepage are used to filter writeback pages. This approach does not wo...

Astra Linux – vulnerability in binutils

An issue was discovered in the Binary File Descriptor BFD library also known as libbfd, included in GNU Binutils 2.31. An invalid memory access exists in bfdstabsectionfindnearestline within syms.c. Attackers can exploit this vulnerability to induce a denial of service application crash by using ...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process could perform arbitrary chmod operations on the target...

Astra Linux – vulnerability in libde265

LibDe265 v1.0.4 contains a global buffer overflow in the decodeCABACbit function, which can be exploited via a specially crafted file...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel 6.0.8, there is a use-after-free in the rununpack function in fs/ntfs3/run.c, which is related to a difference between the NTFS sector size and the media sector size...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free qgroup space unless specified Boris noticed during his simple quotas testing that a leak occurred due to Sweet Tea’s change in subvol create functionality, which prevented a transaction commit. This was merely ...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2rgrpdump Syzkaller has reported a NULL pointer dereference when accessing rgd-rdrgl in gfs2rgrpdump. This can occur when creating rgd-rdgl fails in readrindexentry. Add a NULL...

Astra Linux – Vulnerability in Wireshark

The pcapng file parser in Wireshark versions 4.6.0 to 4.6.6 allows for denial of service attacks...

Astra Linux – vulnerability in curl

This flaw allows an attacker to insert cookies at will into a running program using libcurl, provided that a specific set of conditions is met. Libcurl performs transfers. Within its API, an application creates “easy handles” which serve as individual handles for individual transfers. Libcurl...

Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a buffer overflow vulnerability that could potentially lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction; a victim must open a specially crafted file...

Astra Linux – Vulnerability in Chromium

Using the "after free" mechanism in the File API in Google Chrome before version 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...